John LaCour, my counterpart at a competitor penned a good overview of the Rock phishing gang's methods.  I would add that his recommendations for "How to Combat Rock Phishing" should be applied to combat all phishing, regardless of the perpetrators or their methods.