Aunty Spam: Frying Phish   5/17/2004 - 1,315 views, 5 Comments

Ted

—

Dear Ted,

The activity you describe has come to be known as “phishing” (pronounced “fishing”), and it is indeed illegal, on many levels and in many ways. Phishing involves making your email appear to be coming from a known company, and then trying to get the target (you) to follow some link and reveal some information such as, as you noted, your password or credit card information.

Phishing has become increasingly common. In fact, SurfControl, a British web and email filtering company, just released the results of a study today which indicates that brand-imitating phishing spam has increased nearly 500% since January.

Despite the fact that phishing attacks are so common, they are actually one of the easiest sorts of spam to prosecute under the law, and, relatively speaking, ridiculously easy for the victim company (the one whose name is being used improperly) to bring to court. That is because, in addition to being illegal under more traditional business and anti-spam laws, such as CAN-SPAM, the use of another company’s domain name in spam is almost always a violation of that company’s trademark, and trademark law is very well established, and it is very easy to bring a lawsuit under trademark law.

So, what should you do if you are the victim of a phishing expedition?

Well, if you are on the receiving end, first of all, and hopefully obviously, don’t click on any of the links!!

Secondly, if you can, take a moment to report the phishing spam to the company whose domain is spoofed (faked) in the headers. For example, if the spam appears to be from PayPal, you can send a copy of it to “spoof@paypal.com”, and if the spam appears to be from eBay, you can send a copy of it to spoof@ebay.com. JavaWoman has a great page on her website with lots of addresses to which you can report phishing and domain spoofing, at http://banspam.javawoman.com/report3/scam3.html

If it is your company which has been spoofed, you should immediately speak with your attorney about filing a trademark infringement lawsuit. Trademark infringement has been used very successfuly in recent times to stop spammers dead in their tracks - usually you can get an injunction within 24-48 hours of filing a trademark infringement lawsuit, and trademark law also allows you to hold anyone who is facilitating the phishing attack legally accountable as well. This means it is very easy to get the ISPs, any affiliate programs, and anyone else who is involved, to tell you which of their customers are involved in the scam.

So be you recipient or the infringed, grab hold of your phish and say “we’re not going to take it anymore!”

Kissy kissy,

Aunty Spam