Scammers baiting their fraud hook with the promise of a $400 windfall from Google are actually only after credit card accounts, a security company has warned.

According to San Diego-based Websense, the phish starts with a spammed e-mail that directs recipients to a spoofed Google front page that includes the phrase "You WON $400.00 !!!" and instructions on how to collect the winnings.

Those instructions are the heart of the fraud: the $400 will be transferred to the user's credit card account if the winner provides the card number, name and phone number associated with the account, and the card's four-digit verification number.

When Websense issued its warning Tuesday, the U.S.-hosted fake site was online. The phone number prominently displayed on the site, however, was not in service, as good a clue as there is that a scam was in the works.

Phishing attacks remain a major threat, even though their number has fallen off for two months straight. In mid-October, the Anti-Phishing Working Group (APWG) reported that the number of attacks had decreased by three percent in August, the last month for which data was collected.

The slip in the number of attacks, said the APWG, may have been due to the use of more sophisticated phishing tactics that don't rely on e-mails, but instead turn to "drive-by downloads" of malicious code, including keyloggers, when people surf to specific Web sites.