Anti-phishing laws on the cards

The US is drawing up a law to outlaw phishing, and EU legislation is likely to follow

Phil Muncaster, IT Week 10 Mar 2005

Moves to introduce specific anti-phishing laws in the UK could begin this year, following proposals for such legislation in the US to combat the growing problem of identity theft.

The US Senate began debating the proposed Anti-Phishing Act of 2005 earlier this month. If it becomes law, fraudsters found guilty of sending phishing emails - which collect personal data to defraud victims - would face up to five years in prison and up to $250,000 in fines.

Jon Fell, internet specialist at law company Pinsent Masons, said the UK could follow the US in introducing anti-phishing laws "sooner rather than later". He added that early draft regulations could be drawn up as early as the end of 2005.

But Fell argued that any change in the UK's fraud laws would only be one step towards reducing online ID fraud. He said it is more important for businesses to improve their online security systems and for the public to be educated in fraud-prevention measures.

"In the long term, if the public know what they are doing they're less likely to be worried about using the internet," Fell said.

However, public fears are likely to increase following a recent report by consumer watchdog Which? that revealed a quarter of UK adults have had their identity stolen or know somebody who has been a victim of ID fraud.

Dave Birch, director of IT consultancy Consult Hyperion, said banks and businesses should work together to change their online payment systems, to increase faith in web security.

"We need to move away from passwords to things like smartcards and we need to do it as quickly as possible," Birch argued. "Chip and PIN technology could also be adapted for use at home on a PC for online payments, but it's down to the industry to make it work."

Geoff Haggart of internet security company Websense argued that the public should share responsibility for preventing online ID fraud by taking more care to check that emails are legitimate.

"People sometimes don't think to question if an email is legitimate or not before opening it. Just by being vigilant and thinking before clicking OK or following a link they can prevent ID fraud," Haggart said.

See also: