In a networked computer system, a user accesses a webserver via a web interface presenting credentials comprising a user identification. The webserver is communicatively connected to an application server. If fraud with respect to the user identification is detected, the application server sends a notification or alert to add the user identification to a list of compromised user identifications. The system also comprises a database for storing the list of compromised user identifications on a computer. Another category of user identifications is created referred to as phish phood which is comprised of fabricated user identifications.