Why banks shouldn't use frames on their Web pages

A couple months ago, I started getting phishy messages "warning" me about a problem with my SunTrust ATM card. Even with no sleep, I could tell they were bogus - I don't have a SunTrust account (note to phishers:So cut that out). But obviously, some people do. Netcraft reports the Sun Trust phishers figured out how to use SunTrust's own pages in their social engineering.

SunTrust was using HTML frames to embed stock information from a third-party provider on one of its pages. The phishers amended the URL to have one of the frames pick up their bogus "let us rip you off" forms, then sent out their e-mails. Voila: A URL that looked like it really was from SunTrust, because the important part, i.e., the left side, really was.