The thing is most phising attack don't even bother going that far, some people will click on https://foobazbar.com https://foobazbar.com for a "rightly" crafted

The thing is most phising attack don't even bother going that far, some people will click on https://foobazbar.com https://foobazbar.com for a "rightly" crafted mail. HTTPS does not prevent anything here.