Because of the several phishing attacks that have occurred over the years, laws concerning it have been made in the past few years. Congress signed a law, called the Anti-Phishing Act of 2004, which made it illegal to host fraud websites, or to scam others in any other way by phishing. If a person is convicted of phishing, he can be fined up to $250,000 on top of being sent to prison for up to five years. In my opinion, however, only $250,000 should not be sufficient. Especially when one's identity is taken from a phishing scam and how long it takes them to clear up all of the fraudulence.
A Fisher can be caught by Federal agencies that track fraudelent or by being reported by a victim or somone who has caught them. The FTC or Federal Trade Commission, is a main component of stopping the phishers, as well as many other internet fraudulents and scams. Phishing is a serious internet scam, and can be punished very harshly.