Phishing attacks from Yahoo?

Lately I've started to receive phishing attacks from a real, major idiot.  The guy (or gal) sends me a message pretending to be from Bank of America, but the return e-mail address is something from Yahoo!  A few other times, it's from gmail.com.  WTF?  Is there anybody out there who falls for this?