• PC World
• » Consumer Advice

WASHINGTON, D.C. -- The Federal Trade Commission has settled a civil action against a 17-year-old California boy who was allegedly tricking Internet users into giving him their credit card numbers and other personal information on a bogus Web site meant to look like America Online's billing center.

The settlement, announced Monday, will bar the defendant from sending spam and force him to give up about $3500 in profits from his venture, which ran from July to December 2002, before the FBI confiscated his computer. A federal court in central California must formally approve the settlement.

The case has also been forwarded to the Los Angeles District Attorney's Office for possible criminal charges, adds Eric Wenger, an attorney with the FTC's Bureau of Consumer Protection.

Impersonating AOL

The boy's scam allegedly worked like this: Posing as an AOL staffer, he sent customers e-mail claiming a problem with the billing of their AOL accounts. The message warned AOL customers that if they did not update their billing information, they risked losing their accounts, and directed customers to click on a link that allegedly led to the AOL Billing Center.

However, the link led to the defendant's site, which included AOL's logo, type style, and links to real AOL Web pages. The defendant's AOL look-alike page directed consumers to enter the numbers from the credit card they had used to charge their AOL account, then asked consumers to enter numbers from a new card to correct the problem. The defendant's page also asked for consumers' names, mothers' maiden names, billing addresses, social security numbers, bank routing numbers, credit limits, personal identification numbers, and AOL screen names and passwords.

The defendant used the information to charge online purchases and open accounts with PayPal, and he used consumers' names and passwords to log on to AOL in their names and send more spam. He also recruited others to participate in the scheme by convincing them to receive fraudulently obtained merchandise he had ordered for himself.

Known as "phishing," the fake Web site scam victimized both AOL and its customers, says Timothy J. Muris, FTC chair, in a statement. The case represents the FTC's first law enforcement action targeting phishing, but it won't be the last, Muris promises.

"We're trying to draw attention to it, so customers recognize this type of scheme," Wenger adds.

Consumers Warned

Although AOL was the target in this case, the scheme can be run on just about any ISP or e-commerce provider, Wenger notes. Such scams are agnostic to the type of connection Internet users have or their brand of ISP, notes Nicholas Graham, an AOL spokesperson.

"Scams are like the flus of the Internet--anybody can and will catch them," Graham says.

AOL has told customers for years that they shouldn't trust e-mail that asks for personal information such as passwords or credit card numbers, Graham says. "We applaud the FTC for highlighting an issue that AOL has concentrated on for some time," Graham adds.

Graham recommends customers who recognize such schemes tell their ISPs so the scam artists can be stopped before someone becomes a victim. "Before you hit the delete button, do a community good deed and always report scams," he says.

The FTC offers tips for consumers on avoiding identity theft. The material warns consumers who receive e-mail threatening an account shutdown unless they reconfirm billing information to not reply or click on the e-mail link. Consumers should contact the company that supposedly sent the message using a telephone number or Web site address they know to be genuine.

• See more like this:
• cybercrime,
• crime,
• security,
• privacy,
• identity theft,
• thief,
• spoof,
• phish,
• phishing,
• fbi,
• federal trade commission,
• ftc,
• aol,
• America online,
• scam,
• spam,
• hoax