...but the economics of such an attack are still very different from when the same thing happened to chase.com or td.com or some other bank that had consumer ba

...but the economics of such an attack are still very different from when the same thing happened to chase.com or td.com or some other bank that had consumer banking. Because you can send phishing e-mails to the general public and get a pretty good hitrate of people who happen to be in business with that bank and very much used to conducting their business with that bank through that same domain. For GS.COM that hit-rate would be extremely small, unless you were somehow able to to reach people who are in business with GS with very high accuracy, and then the next problem you'd face is that the trust that these people put in GS.COM doesn't extend to doing any kind of business there. If you're a Norwegian oil company and you have GS handle your USD Forex forward contracts, then the way you do that kind of business is that you call somebody on the phone who works at GS, whose voice you recognize, who has likely invited you to their wedding at some point. You wouldn't expect them to send you an e-mail that put you into a web-flow on GS.COM that somehow ended up with you wiring a few million to an account number they display on-screen.