The thing about security is, well, security happens, and sometimes it doesn't happen, and then sometimes it's over the edge with mind-numbing incomprehensibility. I tend to notice these things.

I was on the road recently. I forgot/lost/misplaced my password to log on to Internet banking so I could pay my staff. I called 1-800-Amsouth and asked for my password. They asked me for: 1) my name; 2) account name and number; 3) address; 4) federal ID number; and 5) date of birth. Then they gave me my password.

My wife overheard the conversation and raised hell with me about how easy it was to gain access to our intertwined online accounts with no decent security check. AmSouth's proof-positive security check was, in fact, public information.

Then it only got worse. AmSouth called me at home. The woman on the phone said she needed to discuss a problem with me, but first I needed to answer a couple of questions. Then she proceeded to ask me for personal information to "protect me" and "confirm my identity."

What's wrong with this picture? Millions of e-mail phishing attacks reach out to snag gullible somebodies - for financial gain or identity theft. One type of phishy e-mail induces a greedy victim to respond, promising vast wealth. Others attempt to lure the unsuspecting into "fixing" their PayPal or bank accounts. Then there are those that use fear: "Your account is in serious delinquency," or "You just bought four plasma TVs and we want to confirm your order," or "The wire transfer you initiated for $10,000 needs secondary confirmation."

What do you think? Discuss this column and phishing.

Spear-phishing fine-tunes the art to select companies specifically targeted for their assets. It's all about the money.

Especially in the financial sector, we teach companies and their staff about social engineering, identity theft, phishing and all the ways the bad guys want to scam you, your company and your customers. Then we teach them what not to do - how not to respond to phishing or suspicious activity at work or at home, so they can avoid becoming victims.

Here was AmSouth acting and operating just like a criminal enterprise trying to scam personal information from me. It was using the same techniques phishers use to try to get hapless victims to release private information as a pretext to identity theft.