Some of these sites look so genuine that I can understand how people can be duped. A few weeks ago I bought a new laptop, and when I tried to log in to internet banking it said that my user name was invalid. It looked to all intents and purposes like the usual HBSC site. When I clicked on the 'Forgot your username' button it asked me for
a) my social security number (what's one of them?)
b) my account number
c) my PIN
The last one set the alarm bells ringing as it is well known that banks never ask you for your PIN. I obviously had logged in to a rogue site but it looked just like the genuine article.