by richm at March 8, 2004 @ Netcraft

Internet "phishing" scams are incorporating the use of SSL certificates - both real and faked - in their efforts to trick users into divulging sensitive login information for financial accounts.
This trend bears watching, as the presence of an SSL certificate was initially touted by consumer protection groups as a way to differentiate between scams and legitimate sites. The U.S. Federal Trade Commission, for example, offered this advice to consumers concerned about phishing: "Before submitting financial information through a Web site, look for the "lock" icon on the browser's status bar. It signals that your information is secure during transmission."

But security professionals are focused on the limitations of SSL in the wake of a recent scam targeting Earthlink users (mentioned near the bottom of this story) which employed an SSL certificate so the bogus page displayed the lock icon. In this case, the certificate appeared legit because it matched the URL of the fake page mimicking the Earthlink web site, but had no connection to Earthlink. Visitors would only detect the deception if they reviewed the certificate.

The SANS Institute's Internet Storm Center noted the scam, and advised its users that "it is not possible to identify fake or real websites by the lock icon alone. ... While you can assure that the session is encrypted, it is not possible to ensure that this is the real organization."

Read More Here