California makes phishing punishable by law