Phishing fight may be paying off