AOL filed three civil lawsuits against several major phishing gangs on Tuesday as part of the ISP's wider fight against identity theft scams and other internet security threats.

The suits (overview (http://corp.aol.com/press/phish_summary.shtml)) cite Virginia's anti-phishing statute, adopted in July 2005. AOL's suit also uses the Federal Lanham Act (trademark law), and the Federal Computer Fraud & Abuse Act.

The ISP is seeking damages of $18m against unnamed groups who targeted AOL and CompuServe members with fraudulent emails that attempted to trick them into handing over confidential personal information (such as AOL screen names, passwords, and credit card numbers) to bogus websites that mimicked the appearance and feel of official AOL or CompuServe websites. According to the lawsuits, these phishing fraudsters used "vast resources and creativity" to design hundreds of fake websites. AOL has kept tens of thousands of examples (http://corp.aol.com/press/phish_screenshots.shtml) of phishing fraud emails transmitted by these gangs.

Curtis Lu, senior VP and deputy general counsel at AOL said: "At AOL, we are using every legal and technical means at our disposal to drive phishers from the AOL service, not only to protect our members, but to make the internet a better, safer place for all consumers. The phishers targeted in our lawsuits spoof a variety of prominent internet brands, including AOL."

According to the Anti-Phishing Working Group almost 50,000 phishing websites were created last year, with more than 7,000 appearing in December alone. AOL said it is committed to fighting spamming and phishing both legally and by using technologies such as its recently introduced certified mail programs. It said it blocks an average 1.5bn spam emails a day, approximately 80 per cent of the email traffic sent to users' in-boxes. AOL also blocks delivery of emails with web links to known phishing sites. Access to known phishing sites is also blocked for users of AOL Explorer browsers. The ISP partners with anti-phishing firms MarkMonitor, Cyveillance and Cyota in delivering providing protection against phishing attacks. ®

Related stories

AOL phishing fraudster found guilty (17 January 2007)
http://www.theregister.co.uk/2007/01/17/aol_phishing_fraudster/
Prison terms for phishing fraudsters (14 November 2006)
http://www.theregister.co.uk/2006/11/14/fraud_act_outlaws_phishing/
Phishers aim to hook MySpace users (5 June 2006)
http://www.theregister.co.uk/2006/06/05/myspace_phishing_attack/
AOL still on the slide (4 May 2006)
http://www.theregister.co.uk/2006/05/04/aol_financials/
'Smart' phishing attack targets BoI (2 May 2006)
http://www.theregister.co.uk/2006/05/02/boi_phishing_attack/
AOL UK boss get Europe promotion (31 March 2006)
http://www.theregister.co.uk/2006/03/31/aol_md/
MS lawsuits aim to reel in phishers (20 March 2006)
http://www.theregister.co.uk/2006/03/20/ms_phishing_lawsuits/
Phishing fraudsters offer cash reward (14 March 2006)
http://www.theregister.co.uk/2006/03/14/chase_phishing_scam/
Phishing fraudsters aim to outpace site shutdowns (8 March 2006)
http://www.theregister.co.uk/2006/03/08/smart_redirect_phish_attack/
AOL's email tax - charities get reprieve (6 March 2006)
http://www.theregister.co.uk/2006/03/06/no_charges_for_charities/
Sting nets two spam scam suspects (1 March 2006)
http://www.theregister.co.uk/2006/03/01/spam_scam_sting/
AOL and Yahoo! to charge for emails (6 February 2006)
http://www.theregister.co.uk/2006/02/06/aol_yahoo_charge_emails/
Police collar AOL phishing suspect (27 January 2006)
http://www.theregister.co.uk/2006/01/27/aol_phishing_suspect_arrest/
FTC wants to tweak CAN-SPAM Act (19 May 2005)
http://www.theregister.co.uk/2005/05/19/ftc_consults_on-can-spam_act_tweak/
Phishing gets personal (17 May 2005)
http://www.theregister.co.uk/2005/05/17/personal_phishing/
Brits fall prey to phishing (3 May 2005)
http://www.theregister.co.uk/2005/05/03/aol_phishing/
AOL seeks to block phishing sites (22 April 2005)
http://www.theregister.co.uk/2005/04/22/aol_seeks_to_block_phishing_sites/
Banks 'wasting millions' on two-factor authentication (15 March 2005)
http://www.theregister.co.uk/2005/03/15/2-factor_auth_is_pants/
Phishing for dummies: hook, line and sinker (2 November 2004)
http://www.theregister.co.uk/2004/11/02/phishing_tabbed_browsers/