They have already. I regularly get properly phrased phishing emails from "PayPal". A few times I even got some from the banks that I use. I'm not sure if it was a coincidence or not, but the only thing that gave it away was the phishy URL.