Universities study why phishing works: “about two million Americans gave their personal information to phishing sites in 2003”