And yet, criminals create banking trojans at scale. They wouldn't do this if it was more effective to always do traditional phishing.