One strategy for combating phishing is to train users to deal with phishing attempts. User education can be promising, especially where training provides direct feedback to the user on his success (or otherwise). One newer phishing tactic, which uses phishing emails targeted at a specific company, known as spear phishing, has been harnessed to train users at various locations, including West Point Military Academy. In a June 2004 experiment with spear phishing, 80% of 500 West Point cadets who were sent a fake email were tricked into revealing personal information.
Users can take steps to avoid phishing attempts by slightly modifying their browsing habits. Users who are contacted about an account needing to be « verified » (or any other topic used by phishers) can contact the company that is the subject of the email to check that the email is legitimate, or can type in a trusted web address for the company’s website into the address bar of their browser to bypass the link in the suspected phishing message.
Nearly all legitimate email messages from companies to their customers will contain an item of information that is not readily available to phishers. Some companies, like PayPal, always address their customers by their username in emails, so if an email addresses a user in a generic fashion (« Dear PayPal customer« ) it is likely to be an attempt at phishing. Emails from banks and credit card companies will often include partial account numbers. However, recent research  has shown that typical users do not distinguish between the first few digits and the last few digits of an account number. This is a significant problem since the first few digits often are the same for all clients of one financial institution. One should always be suspicious if the message does not contain specific personal information. Phishing attempts in early 2006, however, used such highly personalized information, making it unsafe to rely on personal information alone as a sign that a message is legitimate. Furthermore, another recent study concluded in part that the presence of this information does not significantly affect the success rate of phishing attacks, suggesting that most users do not pay attention to such details anyway.
The Anti-Phishing Working Group, an industry and law enforcement association, has suggested that conventional phishing techniques could become obsolete in the future as people are increasingly aware of the social engineering techniques used by phishers. They propose that pharming and other uses of malware will become more common tools for stealing information.
Source : wikipedia