"That said, when Grandma first signed up at building-and-loan.com, she probably went to the correct site."<p>When I first followed this thread, I had this same thought. And it's true for this scenario. Maybe it's even true for most bank customers.<p>But it does depend on that scenario, a user typing in the address on her own. What gave me doubt was an equally (more?) likely scenario, clicking on an affiliate link. People trust links, and most probably don't look at their status bar on hover.