Banks on the UK used to love them. To log on to your account they would open a pop up with no URL bar so you no longer knew who you were connected to. There were some easy exploits to replace the popup with a fake.