Dave Naffziger's Blog

Done by an organization with an SSL certificate issued to mountain-america (different from mountain america credit union).

http://isc.sans.org/diary.php?storyid=1118

Tons of issues that the industry hasn’t even begun to address. When will banks and credit card companies realize that users will always be duped.

Authentication is the bank’s responsibility, and needs to be done at the bank login. They must start with the expectation that every user has given their password away. Several interesting companies helping banks fight this:

http://www.guardiananalytics.com
http://www.41stparameter.com