Trained in the sense that, over time, many of them have learned, or read or been told to pay attention to the URL for security reasons. They are trained by thei

Trained in the sense that, over time, many of them have learned, or read or been told to pay attention to the URL for security reasons. They are trained by their friends, by blogs, websites, (my bank website frequently reminds me to check the URL), articles in print media, etc. Now, this doesn't mean users won't still be conned. But its important not to be blase about the worth of that accumulated knowledge. It takes a lot of time - and cases of fraud - before knowledge like "I should check the URL" filters down to the average user. This knowledge, having been thus accumulated, shouldn't be casually discarded, or undervalued, by those of us who do computers for a living. Its hard to train users to follow security procedures at the best of times, without changing the rules. Examples of what I'm talking about, from a quick Google: "look for indicators that the site is secure, like a lock icon on the browser’s status bar or a URL for a website that begins https:" http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt127.shtm "A phishing site may look exactly like the real site, but the URL will look strange." http://www.ehow.com/how_5236627_avoid-online-like-fake-paypal.html http://www.ehow.com/how_5236627_avoid-online-like-fake-paypa... http://www.microsoft.com/protect/fraud/phishing/spoof.aspx http://www.microsoft.com/protect/fraud/phishing/spoof.aspx There are a plenty of examples of similar articles.