Secondly, while I agree with your "Don't get mad, get even" statement, I disagree with methodology. I don't think that attacking bad guys will lead you anywhere. I would instead help the good guys. And one of the ways to help good guys is education. Banks (and other organizations) should be properly notified that about bad guys around spoofing their sites and producing all sorts of other dirt. Users should be educated about different techniques of misleading them, such as "@" character in the URL. They should be taught to make sure that they are using secure connection with the properly signed and generated certificate from the appropriate bank.

I beleive that a well educated user is capable of securing himself/herself from a great variety of problems.

Take these 2 cents, they are yours. :)

Update: sauoq is faster then me. :)