A method (200,300) comprising: determining whether new phishing site identifiers have been created, wherein upon a determination that said new phishing site identifiers have been created, said method further comprising: comparing (214,314) said new phishing site identifiers to site identifiers of sites to which critical values have previously been provided, wherein upon a determination that at least one of said new phishing site identifiers matches at least one of said site identifiers of sites to which critical values have been provided, determining that critical values have been provided to a site which has been discovered to be a phishing site, said method further comprising: upon the determination that at least one of said new phishing site identifiers matches at least one of said site identifiers of sites to which critical values have been provided, providing a phishing notification to a user that provided the critical values to the site, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site, and the actual critical values previously provided to the phishing site; and providing a phishing notification to at least one of a merchant impersonated by the phishing site, a credit bureau, or a law enforcement agency, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site. determining whether new phishing site identifiers have been created, wherein upon a determination that said new phishing site identifiers have been created, said method further comprising: comparing (214,314) said new phishing site identifiers to site identifiers of sites to which critical values have previously been provided, wherein upon a determination that at least one of said new phishing site identifiers matches at least one of said site identifiers of sites to which critical values have been provided, determining that critical values have been provided to a site which has been discovered to be a phishing site, said method further comprising: upon the determination that at least one of said new phishing site identifiers matches at least one of said site identifiers of sites to which critical values have been provided, providing a phishing notification to a user that provided the critical values to the site, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site, and the actual critical values previously provided to the phishing site; and providing a phishing notification to at least one of a merchant impersonated by the phishing site, a credit bureau, or a law enforcement agency, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site. comparing (214,314) said new phishing site identifiers to site identifiers of sites to which critical values have previously been provided, wherein upon a determination that at least one of said new phishing site identifiers matches at least one of said site identifiers of sites to which critical values have been provided, determining that critical values have been provided to a site which has been discovered to be a phishing site, said method further comprising: upon the determination that at least one of said new phishing site identifiers matches at least one of said site identifiers of sites to which critical values have been provided, providing a phishing notification to a user that provided the critical values to the site, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site, and the actual critical values previously provided to the phishing site; and providing a phishing notification to at least one of a merchant impersonated by the phishing site, a credit bureau, or a law enforcement agency, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site. upon the determination that at least one of said new phishing site identifiers matches at least one of said site identifiers of sites to which critical values have been provided, providing a phishing notification to a user that provided the critical values to the site, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site, and the actual critical values previously provided to the phishing site; and providing a phishing notification to at least one of a merchant impersonated by the phishing site, a credit bureau, or a law enforcement agency, the phishing notification comprising the date and/or time when the critical values were provided to the phishing site.