Dad just got nailed by an email phishing attempt. They simulated an (outrageously expensive) Itunes purchase that he never made, and gave him a carefully crafted address that looked like Itunes to dispute it. He went there, was prompted to give them his financial data, etc. -- which he did.
He realized something was wrong as soon as he did it, touched base with me and one of my brothers (his IT department).
Anyway, he's been spending his afternoon making phone calls. His old credit card has now been canceled, new one on the way, he removed his billing info from his Itunes account, etc. It's going to be a pain in the butt.