I got some NatWest phishing spam the other day and was amused to notice this:
<title>NatWest - Security Information</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<link rel="stylesheet" type="text/css" href="http://www.natwest.com/microsites/global/phishing_demo/includes/css/generic.css" media="all" />
...
<a href="http://www.natwest.com/"><img src="http://www.natwest.com/microsites/global/phishing_demo/images/h_logo.gif" alt="NatWest - Load home page" /></a>
Enterprising of them to actually uses NatWest’s explanation of phishing to … phish.