Christopher Abad, a research scientist with Cloudmark, a San Francisco-based spam filtering service provider spend time lurking (possibly using bots) in phishing communities and gained valuable understanding on their economies and social structure.

To summarize the economy is still based on demand-and-supply (no surprise here) - "Phishing economies are self-organized merchants and consumers governed only by the laws of supply and demand".

Abad probed the inner workings of phishers by analyzing hundreds of thousands of messages collected from 13 key phishing-related chat rooms and several thousand compromised computers used to run bots as well as host the bogus Web sites that phishers use to trick users into divulging confidential data, such as bank and credit card account information.

He found no gang like behavior of these loose communities. "Phishers are very loosely-affiliated people," he said. "That's the nature of the system."

What I found interesting was:

"It's no surprise that Washington Mutual, Key Bank, and various other institutions are at the top of the phishers' lists," he said. "The tracking algorithms for these institutions are easily obtained from within the phishing economy, while Bank of America, a huge financial institution, is nearly off phishers' radar because its encoding algorithm is very hard to obtain or crack.

Apparently Washington Mutual is mending their ways now.

Link