It only drives up the cost of phishing attacks if the customer actually expects the EV cert UI and is willing to bail if they don't see it. One of the major iss

It only drives up the cost of phishing attacks if the customer actually expects the EV cert UI and is willing to bail if they don't see it. One of the major issues with EV is that, while seeing the EV cert may give the user confidence that they're visiting the business they intended to, not seeing the EV cert is not detrimental in any way, because users generally don't expect to see them. And a personal anecdote to back this up: I'm a pretty savvy web user, I've been around for a while and visit lots of websites, and yet if you were to put a gun to my head and tell me I had to name a website that I was confident would have an EV cert, the only site I could possibly name is my bank, and even that I'm not positive about, I just know that banks usually have EV certs. (just checked, my bank does in fact have an EV cert)