Some IT security group had a test where they'd show you a bunch of pages some of which were scams and some of which were legit. Amazingly, even among educated IT professionals, only about 25% were able to accurately detect which pages were legit and which were phishing pages.

The scammers are getting more and more legitimate, and Slashdot recently referenced an article in which someone demonstrated how the two-tiered login approach that Bank of America and others recently switched to can easily be compromised.