New California Law Makes Phishing Illegal

The state of California has passed the Anti-Phishing Act of 2005, the first law in the nation to make phishing a crime. Under the new legislation, phishing will be punishable by thousands of dollars in fines, and individual victims may receive as much as half a million dollars each in damages from the perpetrators.

Phishing scams typically involve fraudulent spam email sent to thousands of recipients at once. The messages, which generally incorporate the highjacked logos and spoofed return addresses of financial institutions and other legitimate businesses, are designed to trick recipients into revealing such sensitive information as bank account numbers, usernames and passwords, and Social Security numbers.

The new California law, proposed by state Senator Kevin Murray and signed into law on 30 September 2005, is the first in America to make phishing a specific crime. Previously, phishing scammers have been prosecuted under more general anti-fraud laws.

Under the new phishing law, government prosecutors in California can seek penalties as high as $2,500 per violation. In addition, victims of phishing scams may seek to recover either the cost of the damages they have suffered or $500,000, whichever is greater.

Phishing attacks have increased dramatically over the past two years. A study released by research firm Gartner in May 2005 estimated that 73 million U.S. Internet users had received phishing emails during the previous 12 months, an increase of 28 percent over the year before.

While the new law may not produce an immediate reduction in phishing attacks, its supporters expressed satisfaction that prosecutors and victims of the crime will have another weapon against their perpetrators — at least in California. Nationwide outrage over rampant identity theft scams and security breaches involving personal and financial information also increases the likelihood that a similar measure will be introduced at the federal level.