Phishing e-mails that reach consumers are impersonating banks less often, and other brands, such as PayPal and eBay, more often. Banks and credit card company refunds to consumers who lost money because of phishing attacks are declining as a percentage of total refunds, while refunds from nonfinancial services companies and retailers are growing as a percentage of total funds.

"Cyber-criminals are starting to shift away from attacking online banks directly, and they are leveraging less conventional brands and/or using hard to detect social engineering methods to reap financial gains," says Litan.

"Countermeasures such as phishing detection and take-down services deployed by banks, Internet service providers (ISPs) and other service providers are obviously not sufficiently widespread or effective."