To criminalize Internet scams involving fraudulently obtaining personal information, commonly known as phishing.

July 9, 2004

Mr. LEAHY introduced the following bill; which was read twice and referred to the Committee on the Judiciary

To criminalize Internet scams involving fraudulently obtaining personal information, commonly known as phishing.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as the `Anti-phishing Act of 2004'.

SEC. 2. FINDINGS.

Congress finds the following:

(1) American society is increasingly dependent on the Internet for communications, entertainment, commerce, and banking.

(2) For the Internet to reach its full potential in these and other respects, it must continue to be a trustworthy medium. This means, for example, that Internet users should be able to trust the stated origin of Internet communications and the stated destination of Internet hyperlinks.

(3) Internet users are increasingly subjected to scams based on misleading or false communications that trick the user into sending money, or trick the user into revealing enough information to enable various forms of identify theft that result in financial loss.

(4) One class of such scams, called `phishing', uses false e-mail return addresses, stolen graphics, stylistic imitation, misleading or disguised hyperlinks, so-called `social engineering', and other artifices to trick users into revealing personally identifiable information. After obtaining this information, the `phisher' then uses the information to create unlawful identification documents and/or to unlawfully obtain money or property.

(5) These crimes victimize not only the individuals whose information is stolen, but the entire online community, including millions of people who rely on the integrity of the Internet's system of addresses and hyperlinks.

SEC. 3. CRIMINAL OFFENSE.

(a) IN GENERAL- Chapter 63 of title 18, United States Code, is amended by adding at the end the following:

`Sec. 1351. Internet fraud

`(a) WEBSITE- Whoever knowingly, with the intent to carry on any activity which would be a Federal or State crime of fraud or identity theft--

`(1) creates or procures the creation of a website or domain name that represents itself as a legitimate online business, without the authority or approval of the registered owner of the actual website or domain name of the legitimate online business; and

`(2) uses that website or domain name to induce, request, ask, or solicit any person to transmit, submit, or provide any means of identification to another;

shall be fined under this title or imprisoned up to five years, or both.

`(b) MESSENGER- Whoever knowingly, with the intent to carry on any activity which would be a Federal or State crime of fraud or identity theft--

`(1) falsely represents itself as being sent by a legitimate online business;

`(2) includes an Internet information location tool that refers or links users to an online location on the World Wide Web that falsely purports to belong to or be associated with such legitimate online business; and

`(3) induces, requests, asks, or solicits a recipient of the electronic mail message directly or indirectly to provide, submit, or relate any means of identification to another;

shall be fined under this title or imprisoned up to five years, or both.

`(c) DEFINITIONS- In this section:

`(1) The term `domain name' has the meaning given that term in section 46 of the Act entitled `An Act to provide for the registration and protection of trade-marks used in commerce, to carry out the provisions of certain international conventions, and for other purposes' (in this subsection referred to as the `Trademark Act of 1946') (15 U.S.C. 1127).

`(2) The term `Internet' has the meaning given that term in section 230(f)(1) of the Communications Act of 1934 (47 U.S.C. 230(f)(1)).

`(3) The term `electronic mail message' has the meaning given that term in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702).

`(4) The term `initiate' has the meaning given that term in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702).

`(5) The term `procure' means intentionally to pay or provide consideration to, or induce, another person to create a website or domain name.

`(6) The term `recipient' has the meaning given that term in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702).

`(7) The term `Internet information location tool' when used in this section has the meaning given that term in section 231 of the Communications Act of 1934 (47 U.S.C. 231).

`(8) The term `means of identification' when used in this section has the meaning given that term in section 1028 of this title.'.

(b) CHAPTER ANALYSIS- The chapter analysis for chapter 63 of title 18, United States Code, is amended by adding at the end the following:

END