California Makes Phishing Illegal

California has passed an antiphishing law, making this form of identity theft punishable by thousands of dollars in fines.

The law, entitled the Anti-Phishing Act of 2005, was proposed by state Senator Kevin Murray, and was signed into law on Friday. It is the first such antiphishing legislation to be enacted in the country, according to backers of the bill.

Correction: California is not the first state to adopt an anti-phishing law. With the passage of the Anti-Phishing Act of 2005, California joins such states as Texas, New Mexico, and Arizona, all of which adopted antiphishing legislation earlier this year.

"It's something that adds another tool in the quiver for consumers and businesses to reduce this kind of really bad behavior," says Michael Wendy, a spokesman for the Computing Technology Industry Association, an IT trade association that has supported the law.

Power to Victims

Phishing victims are typically sent fraudulent e-mail designed to trick them into revealing personal information, like bank account numbers, user names, and passwords.

Under the Anti-Phishing Act, these victims may seek to recover either the cost of the damages they have suffered or $500,000, whichever is greater; government prosecutors can also seek penalties of up to $2500 per phishing violation.

While it already may have been possible to prosecute phishers under antifraud laws, the new legislation will make it easier for victims and government to go after phishers, Wendy says.

It may also serve to inspire other legislation, perhaps even at the federal level, he says.

Will It Help?

The new law is unlikely to cut down on phishing, however, at least in the short term, according to Jordan Ritter, chief technology officer with antispam software vendor Cloudmark. However, if the law is upheld in court and actually serves to help victims recover damages, phishers may take note, he says.

Ritter agrees that the Anti-Phishing Act also may serve a symbolic purpose. "Anything that raises people's awareness and improves people's education on the extent of the problem...is going to improve things," he says.

Phishing attacks have been on the rise. Research firm Gartner estimates that 73 million U.S. Internet users received phishing e-mails during the 12 months ended May 2005, up 28 percent from the previous year.