Many people want to do something positive in relation to security, and some of those individuals probably consider taking up arms against phishers. Compared with handling live malware, it seems considerably less risky. However, hidden depths lie beneath the surface and would-be phish hunters should keep the following advice in mind.
Anything you do on phishing pages that gains the owners' attention (populating phish forms with fake data, for example) could potentially hand them lots of revealing information about you. Poorly implemented phish pages often have their data dumps pilfered by others – and at that point, “I fight phishers and here's some of my details” is being posted to underground forums in the most obvious manner.
If you insist on wasting the time of a phisher by spamming them with fake entries, consider that you're potentially wasting the time of others, too. Many organizations scour fresh data dumps, attempting to contact potential victims before their stolen information is used for malicious purposes. This task becomes a lot harder if they have to swim upstream through the digital equivalent of broken bottles and plastic bags, and even trickier if your fake data looks realistic enough to fool the phishers themselves. And there are other serious risks involved when dealing with phishers as well. For example, navigating phish page directories could lead you to drive-by malware or potentially illegal content, and nobody wants that on their system.
Leaving a phisher with a large collection of fake data is still leaving them with a haul of real data too. Instead, consider reporting the page to a site such as PhishTank. With this, you will have done your part, and others with more experience will have the site dealt with.
Fight the good fight, but don't make it a Pyrrhic victory.
