Oh man, the bank one is rough. But to be fair, I think "bankofamerica-secure-login.com" would actually be a legit subdomain if it was set up right, like how some companies do "support.companyname.com" for their help pages. The problem is scammers grab names that look official but aren't actually part of the real domain. I almost clicked a "fedex-delivery-failure.com" link last month because I was waiting on a package and my brain just saw "FedEx" and "delivery" and went into autopilot mode.