[true_religion]

No one is mimicking your bank by putting the info to the right of the domain name.

They mimick the look of the bank and pick a domain like your.bankofamerica.getreadygo.com

[cynwoody]

A few years ago I got an email advising me my account had been compromised, and I needed to follow a link to get the matter resolved.

Mousing over the link, I saw https://www.bankofamerica.com/[lots of gobbledygook followed by an ellipsis]. So, to see it all, I copied it to the pasteboard and pbpasted it into an open Terminal window. The gobbledygook ended with an @-sign and a domain that resolved to a Chinese IP.

About the @-sign syntax: http://stackoverflow.com/a/4981309/315083