A consumer may be looking at a forms page other than the one she believes she is communicating with. For example, although the consumer may believe that she is communicating with Firm X, she may in fact be communicating with another party. URLs are not easy to check, and there have been a number of instances of prank URLs parodying or imitating WWW sites. (For example, https://www.dole96.com is Bob Dole's official 1996 presidential campaign site. On the other hand, https://www.dole96.org is a humorous parody of the Dole election. Reportedly, many users have been fooled.) In the credit card industry, this is a serious concern -- today, fraudulent use of credit cards by merchants is already recognized to be a serious problem (this is sometimes called the ``Lyndon LaRouche problem'' after the fringe presidential candidate who has been accused of credit card fraud.) To address this problem, Visa and Mastercard, in their Secure Electronic Transaction (SET) specification [11], indicated that merchants (both legitimate and bogus) should not receive credit card numbers and similar confidential billing information about consumers. Rather, credit card information entered by consumers should be encrypted before it leaves the local client, so that only an acquiring bank could read the information. Thus, SET addresses the bogus page attack, but leaves open the possibility of local trojan horses.