Oh, yeah, and they often post as legitimate entities, such as banks.
The first sign it's a phishing scam if that they ask for your personal info via email - no legit entity will ever do this. The other indicator is typically poor grammar and misspelled words, as many of these phising scams originate in South America and Africa, where English isn't the first language - least of all, the North American dialects.

A US-based company supposedly sending an email with fluent English, but in more of a British vernacular is another warning sign.