Many Techniques exist on how to scam people using email or websites. This is a list of some of the obfuscation.

(have your eyes open)
URL Obscurity

Using Password fields:
http://username:password@www.example.com/

Ex.
http://www:microsoft.com/download/@www.cipher.org.uk
This link will lead to cipher.org.uk and not Microsoft

Using different Base:
Dword Format
http://dword format
Generalised formula to convert to dword format
Let say that we have a url http://a.b.c.d
DwordURL=((((a*256)+b)*255+c)*256+d)
so now we have http://((((a*256)+b)*255+c)*256+d)

Octal Format
http://octal
Generalised formula to convert to Octal
Let say that we have a url http://a.b.c.d
OctalURL= 0Base8(a).0Base8(b).0Base8(c).0Base8(d)
You need at least one leading zero.

Hex Format
http://hex
Generalised formula to convert to Hex
Let say that we have a url http://a.b.c.d
HexURL = Base16(a).Base16(b).Base16(c).Base16(d)
or
HexURL = Base16(a.b.c.d)

Using Redirection
Lets say that IBM use a script which can load another
webpage inside their main website :
e.g. :http://www.IBM.com/url?p=http://www.google.com.
You can use that to exploit trust.

Using Cross Site Scripting
Reported vulns on different web applications provide
crossscripting gateway for the Phiserman.

-Via Search engine
 Be sure that the search engine in your organisation
 doesnt accepts JavaScript,VBScript,HTML,JSP or
 any active content injection.
 Type that
 alert('css')
 if this doesnt work , go to a Hex converter and
 convert that into Hex. Then paste it in the
 search engine field and press search.
(If it is vuln attacker can use popup window
to gain trust)

Typographical domain Mistakes
Instead of paypal.com,paypai.com,paypa1.com
Gain trust exploiting human vision.

Visual spoofing
Is possble if :
You create a popup window which you set it not
to have scroll bars,status bar etc. You reporgram
the interface with javascript and you add SSL lock.

Browser Bugs
Using different browser bugs you can fake
url or a Certificate :

-Extensive amount of characters can disable
 status bar view of a link
-Using this You can gain trust using someone else's
Certificate and URL.(new bugs come every day)

Proxying
Fake direct session using proxy. Provide a link
to a legitimate website,using any of the previous
bugs, load the legal website via you proxy. SSL
certificate,forms,webpages ...everything will be
real but everything will be passed to the victim
via your proxy , so you can sniff the communication.

Historical Phishing Example
http://www.math.org.il/pic.gif