The problem is even the brightest of us can be fooled by what appear to be genuine sites. When I bought my latest laptop a few months back I tried to log into my bank account. It would not accept my userid even though I knew it was correct. Instead it directed me to another page which said that their procedure had changed. I was to provide my social security number (which doesn't exist in this country as far as I am aware), my password and my PIN. It was the pin which gave the game away as I then realised I had landed on a dodgy website. What I had done, as it was a brand new computer so I didn't have a bookmark, was to google the bank. It looks as though rogue sites appear at the top of the list.