It's official... yesterday, New York's Governor George Pataki signed a law making phishing illegal:
The Anti-Phishing Act of 2006 prohibits the deceptive solicitation of personal information through electronic communications. Internet service providers, affected trademark holders or the Attorney General are authorized to bring an action to recover the greater of actual damages or $1,000 per violation. Treble damages are also allowed when the court finds that a person has engaged in a pattern and practice of phishing.This was part of a trilogy of laws aimed at reducing identity theft (the press release linked above describes all three).
It may seem a little hollow, but our Attorney General (and likely next Governor), Eliot Spitzer, has been aggressive about prosecuting those who target consumers, and he's been involved in a number of spammer prosecutions already.