Thank you for bringing this to light.
It is amazing all the ways that people's accounts are being attacked. I guess the money is simply too tempting.
Perhaps the developers can establish some type of double opt in for any money transactions.
I use my posting key to log in..does this protect against the phishing scams?
It helps, but it doesn't make you immune.