What are the legal implications of phishing compliance?