Online fraud: We got law, but no enforcement

Plenty of laws exist to prosecute online identity thieves and fraudsters, and also to co-opt ISPs and online auction sites into the fight against fraud, but enforcement is lacking across the board, according to security experts.

"Most countries have laws that adequately address Internet fraud," said Paul Luehr, vice president of consulting and technical services firm Stroz Friedberg LLC, in an e-mail interview. "We lack the technical skills to track down these people, and we lack the means of effectively collaborating on investigations across national boundaries."

The Internet community worldwide has recently seen an upsurge in phishing scams, or the online exploits by people attempting to steal sensitive information such as a password, bank account or credit card number, often under the guise of updating account information.

For example, the Nigerian 419 or advance fee fraud continues to take victims. A U.K. man was jailed this week for six years for defrauding his own employers in order to raise money to use in a fake bank transfer scheme.

Meanwhile, Australian online betting sites have been targeted by Russian extortion gangs, who have flooded the sites with traffic, effectively closing them down, after the sites refused to pay protection money of $20,000.

And online auction sites are now routinely targeted for check fraud, where a buyer pays for goods with a fake check which is not discovered until the goods have been shipped.

"One of the major issues is that a lot of these crimes are perpetrated by individuals outside of the U.S. and in countries where law enforcement does not have a cooperation with ISPs," said Jahan Moreh, chief security architect of Secure Data in Motion's Sigaba business unit, in an e-mail interview. "That is why we are a major proponent of educating people by making them aware of the issues and what they should watch for."

Yet, inside the U.S., there are a number of laws which could be applied to online fraudsters, according to Luehr. Phishing could be prosecuted under laws relating to identity theft, credit, hacking, mail fraud, wire fraud, releasing viruses and spamming.

The wire fraud statute alone can carry a penalty of 30 years in prison and a fine of $1 million if a bank is affected, Luehr said.

The setting up of fake bank Web sites, which have become an integral part of the 419 fraud, violates U.S. criminal and civil laws that prohibit fraud, deceptive advertising, unregulated banking and the sale of unregistered securities. The Securities and Exchange Commission has prosecuted dozens of cases of these types, according to Luehr.

According to Internet anti-fraud watchdog groups, ways of attacking bank frauds at their source include ISPs boosting their security, or at least closing down fake bank Web sites and shutting e-mail accounts of known fraudsters. But this relies on the good will of the ISP, which is not always forthcoming.

"Organizations have both the means and the methods to take strong security measures to protect customers and consumers by using technology," said Sigaba's Moreh. "(But) the requirements for privacy protection are in direct conflict with the requirements of security."

The IDG News Service is a Network World affiliate.