Usually when i get them i go into the RS Forums > Account Security > Identifying E-mail Phishing/Identifying Website Phishing, and i ALWAYS report the little bastards to those threads. If you guys would do that toooo... then we could stop this.
But, yeah. I never care to log on RS on the actual website. I always just log in-game, and if i see i have a new message, ill manually go to runescape.com, never have i ever clicked a link from them from my e-mail.
AND! If any pro keyloggers are here, i have ideas for you. You wanna scam a phisher? Make about 10 lvl 3 accounts you don't want. Go to all the phishing sites with them, when they get hacked, recover him back via e-mail/or use the manual. Then get their IP and keylog them to get their accounts. >:]. Would that not be epiiiic?