I found this at ComputerWorld: "The word phishing was coined around 1996 by hackers stealing America Online accounts and passwords. By analogy with the sport of angling, these Internet scammers were using e-mail lures, setting out hooks to "fish" for passwords and financial data from the "sea" of Internet users. They knew that although most users wouldn't take the bait, a few likely would. The term was mentioned on the alt.2600 hacker newsgroup in January 1996, but it may have been used earlier in the print journal 2600, The Hacker Quarterly.
Hackers commonly replace the letter f with ph, a nod to the original form of hacking known as phone phreaking. Phreaking was coined by John Draper, aka Captain Crunch, who created the infamous Blue Box that emitted audible tones for hacking telephone systems in the early 1970s.
By 1996, hacked accounts were called phish, and by 1997, phish were being traded among hackers as a form of currency -- people would routinely trade 10 working AOL phish for a piece of hacking software."
Adapted from material at www.antiphishing.org
