Senate Bill Would Add New Tool To Catch Phishers

In an attempt to cut down on the exponential growth of phishing scams, Sen. Patrick Leahy, D-Vermont, introduced a bill yesterday that defines the penalties for perpetrators.

The Anti-Phishing Act of 2005 calls for fines of up to US$250,000 and prison terms of up to five years for people convicted of the scam, in which phony e-mails and Web sites mimic those of real businesses in an attempt to trick consumers into divulging private information.

The bill also goes after "pharming," in which Internet users are redirected from legitimate sites to phony ones that look real.

US Effort Would Help

The Anti-Phishing Working Group's (APWG) report for January detailed a sharp jump in scams. The group said it received reports of 12,845 new and unique phishing e-mails, up 42 percent from December. It also recorded a leap of 47 percent in the number of phishing Web sites.

Although much phishing activity is hosted on servers or perpetrated by scammers outside the United States, Peter Cassidy, secretary general of the APWG, said the bill nonetheless is a good idea.

"The bill is extremely valuable," Cassidy told TechNewsWorld, partly because it makes phishing itself a federal crime. Currently, law enforcement officials must go after phishers with other criminal laws -- such as those dealing with wire fraud -- or civil laws covering such matters as trademark violations. The bill would allow prosecutors to go after scammers just for building the bogus sites.

The APWG report found that 32 percent of phishing sites are hosted in the United States. China was second with 13 percent.

"It means that if you're organizing a scam, it's explicitly against the law," he said. "If you're in the U.S., that works, but if you're international, it doesn't help."

International Cooperation Needed

The key will be enlisting overseas help.

"The interesting part of phishing is that by its nature it's an international crime. You need cooperation across jurisdictional frontiers," Cassidy said.

The vast majority of phishing expeditions are aimed at financial institutions. Consumers should be aware of any changes in the way their bank, brokerage firm, credit card company, etc., communicates with them. If an e-mail format has changed without notice, call the company before following the link. Another telltale sign, Cassidy said, is that while it is easy to spoof an e-mail , it is not easy to spoof individual information.

What's Real

Legitimate correspondence will usually have some partially disguised personal information -- it might say "your account ending in 5555" for instance -- which would probably be missing from a bogus e-mail. If there's any doubt, call the company and ask.

Some in the financial services industry use automated services to monitor the activity around every Web site. When a phisher copies a site, it leaves very distinct markers that can be used, in some cases, to block the site from going up.

"All the monitoring gives you information that can lead you to servers, Web sites and machines being used by the bad guys," Cassidy said, although the phishers themselves can remain elusive. The APWG attributes the vast majority of phishing activity to fewer than 100 groups, who are very busy.