According to CNET, there's a new software package. Costs about $1,000, but it's really slick. You tell it which site's visitors you want to steal from and hit go. It creates a page that looks just like theirs. If they sign-in, they are passed to the legitimate site without even knowing they've just had their identity stolen. If they mistype their address, it displays the correct error message so you can try again. Really sophisticated, so stop clicking on e-mails supposedly sent by your bank.
In other news, we were snowed in today. Didn't really go anywhere. It's amazingly deep.