Phishing is the biggest risk/threat. An average user is typing in his username and password if presented with a decently familiar login form no matter what the browser address bar or the rest of the web page says. Unfortunately the PayPal and Verisign keyfob security codes can also be phished.