Every Internet threat begets an equal opportunity. In the case of phishing, we've seen the toolbar creators fight back with buttons that identify safe and not-so-safe websites. eBay and Earthlink both fight phishing via their toolbars. Google and Yahoo's toolbars block popups and Yahoo has a beta version attacking spyware.

The latest entrant is SpoofStick from CoreStreet. The Internet Explorer plug-in displays the underlying URL in bold letters below the regular browser toolbars. For example, users at a legitimate Citibank site would see, "You're on Citibank.com." Users who've clicked through a phishing message will see something like, "You are at 12.13.92.3.com" which will hopefully prevent users from entering confidential banking information.

Financial institutions should consider making the generic Spoofstick available for downloading from their security areas, or even better, private branded a version that shows the financial institution's own URL in a unique color.