Teen-Aged Identity Thief Nabbed

July 21, 2003
A teen-aged identity thief who allegedly used hijacked corporate logos and deceptive spam to con consumers out of credit card numbers and other financial data has agreed to settle Federal Trade Commission charges that his scam violated federal laws.

Phishing • FDIC Warns Against Fake Bank Failure Scam • Consumers Want Better Online Banking Security • Puddle Phishing: Online Fraud Goes Local • New Phishing Attacks Target Specific Individuals • Online Banking Needs Stronger Security • Offline Identity Theft Still a Threat • Consumers Vulnerable To Exploitation Online and Off • FDIC Warns of Phishing Scam • Consumers Not Secretive Enough, Study Finds • Billions Lost in Phishing Scams • AOL Phishers Settle Federal Charges • AOL, PayPal Phishers Hooked • Citibank E-Mail Scam Making the Rounds • Amazon, Microsoft Sue Alleged Phishers, Spoofers • Teen-Aged Phisher Nabbed --- • Identity Theft News

If the settlement is approved by the court, the defendant, who is not being identified because he is a minor, will be barred for life from sending spam and will give up his ill-gotten gains.

The FTC alleged that the scam, called “phishing,” worked like this: posing as America Online, the con artist sent consumers e-mail messages claiming that there had been a problem with the billing of their AOL account. The e-mail warned consumers that if they didn’t update their billing information, they risked losing their AOL accounts and Internet access.

The message directed consumers to click on a hyperlink in the body of the e-mail to connect to the “AOL Billing Center.” When consumers clicked on the link they landed on a site that contained AOL’s logo, AOL’s type style, AOL’s colors, and links to real AOL Web pages. It appeared to be AOL’s Billing Center. But it wasn’t. The defendant had hijacked AOL’s identity and was going to use it to steal consumers’ identities, as well, the FTC alleged.

The defendant’s AOL look-alike Web page directed consumers to enter the numbers from the credit card they had used to charge their AOL account. It then asked consumers to enter numbers from a new card to correct the problem. It also asked for consumers’ names, mothers’ maiden names, billing addresses, social security numbers, bank routing numbers, credit limits, personal identification numbers, and AOL screen names and passwords - the kind of data that would help the defendant plunder consumers’ credit and debit card accounts and assume their identity online.

According to the FTC, the defendant used the information to charge online purchases and open accounts with PayPal. In addition, he used consumers’ names and passwords to log on to AOL in their names and send more spam. Finally, he recruited others to participate in the scheme by convincing them to receive fraudulently obtained merchandise he had ordered for himself.

“Phishing is a two time scam,” said Timothy J. Muris, Chairman of the FTC. “Phishers first steal a company’s identity and then use it to victimize consumers by stealing their credit identities. This is the FTC’s first law enforcement action targeting phishing. It won’t be the last.”

Back to the top | News