The basic etymology is simple and obvious -- the scammers are "fishing" for gullible customers. The orthographic substitution of ph for f is by analogy to "phone phreaking". I suspect that the band Phish may have been inspired to use the same f-to-ph substitution by the same analogy, but I haven't been able to confirm this.
From the Jargon File 4.4.7:
2. By extension, security-cracking in any other context (especially, but not exclusively, on communications networks) (see cracking).
At one time phreaking was a semi-respectable activity among hackers; there was a gentleman's agreement that phreaking as an intellectual game and a form of exploration was OK, but serious theft of services was taboo. There was significant crossover between the hacker community and the hard-core phone phreaks who ran semi-underground networks of their own through such media as the legendary TAP Newsletter. This ethos began to break down in the mid-1980s as wider dissemination of the techniques put them in the hands of less responsible phreaks. Around the same time, changes in the phone network made old-style technical ingenuity less effective as a way of hacking it, so phreaking came to depend more on overtly criminal acts such as stealing phone-card numbers. The crimes and punishments of gangs like the ‘414 group’ turned that game very ugly. A few old-time hackers still phreak casually just to keep their hand in, but most these days have hardly even heard of ‘blue boxes’ or any of the other paraphernalia of the great phreaks of yore.
[Update: Adam Merton Cooper emails
I was raised in Philadelphia (apparently you work there), home of the baseball Phillies. Officially, the baseball mascot is the "Phanatic", & unofficially many of us call ourselves "phans of the Phightin' Phils". Less obvious is a phenomenon from my college days (1987), in which an acquaintance named Fred drunkenly spelled his own name "P-H-E-D". In the dorm, this spawned substitutions like "P-H-U-N: fun" before spinning out of control ("P-H-T-Y: party!").
All to say that f->ph can happen spontaneously & independently, I think.
Sure enough. It's pretty clear that "phishing" (in the telecom/email scam sense) is based on an orthographic analogy to "(phone) phreaking"; but the band Phish could easily be unconnected. Or connected only by virtue of slightly greater "ph" coolness in the countercultural zeitgeist when the band was being named, due to the phonetic penumbra of phreaking.]
Posted by Mark Liberman at September 22, 2004 08:37 AM