Phishing is not as lucrative as generally thought.