AOL Uses Nation’s First Anti-Phishing Law to Sue Scammers

Virginia is the first state in the U.S. to enact a law giving online businesses the right to sue people engaging in "phishing" to steal information from their customers. Phishers send out official-looking e-mails to people that appear to come from trusted websites, asking for personal information that would allow the phishers to commit fraud or identity theft. America Online (AOL) is the first online company to take advantage of the anti-phishing law, by filing three civil lawsuits against unidentified phishers seeking $18 million in damages.

According to the lawsuits, the phishers sent authentic-looking e-mails to AOL members, portraying the notes as official AOL communications. The notes attempted to lure the recipients to Web sites that mimic the appearance and feel of official AOL or CompuServe websites. When AOL members took the bait and went to the fake site, some were tricked into giving up personal information such as AOL screen names, passwords, and even credit card information. Phishers then would use the information to sell identity information, compromise credit cards, and commit other fraudulent acts based on information provided by the AOL users who fell for the scam.

"Phishing scams have grown more sophisticated and more dangerous to consumers," said Curtis Lu, AOL senior vice president and deputy general counsel. "At AOL, we are using every legal and technical means at our disposal to drive phishers from the AOL service. " AOL, based in Dulles, VA, is the first independent service provider (ISP) to take advantage of the Virginia law, which was passed last summer but has yet to be tested. The lawsuits claim violations of federal trademark laws and the Federal Computer Fraud and Abuse Act. According to papers filed with the lawsuits, the phishing groups used "vast resources and creativity" to design and launch websites that would mislead consumers.

AOL said that as part of its investigation into complaints, it stored tens of thousands of examples of the phishing e-mails transmitted to subscribers. "We are going to continue to play our part in protecting the sanctity and integrity of the e-mail experience of the Web, and today's actions are a part of our ongoing, successful, and comprehensive anti-spam and anti-identity theft work," Lu told reporters when the lawsuits were announced.

AOL claims that their filters catch most phishing e-mails as part of the company’s efforts to block, on average, 1.5 billion spam e-mails daily. AOL also blocks at its gateway 80% of all incoming mail to members as spam. The company also blocks users’ access to known phishing sites using either the AOL software or the AOL Explorer browser. The company has recently launched a program that blocks delivery of e-mails containing links to known phishing sites. By default, the program disables links in e-mails from unknown senders, to add still another layer of protection for members.

Hopefully more states will begin to enact laws to give ISPs the power to reverse the attacks from phishers by taking them to court. Until then, recent statistics indicate that incidents of fraud from Internet-based means may be on the decline. Researchers believe the drop in fraud may be attributable both to more sophisticated filtering systems and more fraud-savvy Internet users. Overall, the FTC last year reported that 46% of all reported fraud complaints with losses of over $335 were Internet-related, down from 52% in 2004. With ISPs and other online companies turning the tables on phishers, the numbers should continue to drop.