I just got a very good phishing email from someone who registered the domain chase-survey.com only 2 days ago. It was so good, I was actually motivated to report it to someone. With some Google searches, I found to forward an email with full headers as an attachment in Thunderbird, I actually had to be viewing full headers, too, otherwise, it just puts the standard basic 4 headers in the forward. Better yet, drag the phishing message into a new email as an attachment to get the full headers without having to view full headers.

I found the following addresses to forward phishing to:

spam at uce.gov
phishing-report at us-cert.gov
spoof at millersmiles.co.uk
scams at fraudwatchinternational.com
reportphishing at antiphishing.org
fraud at phishfraud.com
phishsubmit at wholesecurity.com
report at reportphish.org

I like to think the .gov addresses would be the most important to send to, but I bet they get a huge volume of emails, have a tiny staff, and are only able to follow up on a tiny percent of actual phishing.