• Mission & Governance
• Services Overview
• How to Get Involved
• Standing Committees
• NCSL Foundation

• Issue Areas: A-Z
• State-Federal Relations
• NCSL Standing Committees
• News from D.C. and the States

• About State Legislatures
• Elections, Campaigns & Redistricting
• NCSL's StateConnect Directory
• Web Sites

• Online Guide to NCSL Services
• Staff Sections and Networks
• Meetings & Professional Development
• Staff Directories

• Meetings Calendar
• Online Registration
• Meetings Home Page
• Legislative Summit

• Bookstore
• State Legislatures Magazine
• NCSL's StateConnect Directory

2007 State Legislation Relating to "Phishing"*

Year-end summary

Phishing is a scam where fraudsters send spam or popup messages to lure personal or financial information from unsuspecting victims.  (See OnGuardOnline.gov for practical tips from the federal government and private industry to help guard against Internet fraud).

Summary: Bills introduced in at least 11 states in 2007; enacted in Illinois and Montana.  (See also 2006 Phishing Legislation and 2005 Phishing Legislation )

CALIFORNIA
A.B. 326 
Status: 6/21/07 Referred to Committee on Business, Finance & Industry (phishing provisions removed in amended bill).
Adds instances where the victim might become liable for arrest or face criminal charges to the definition of false "impersonation" and creates an alternate misdemeanor/felony punishable by up to one year in the county jail or a term of 16 months, 2 or 3 years in state prison for any person guilty of unlawful "phishing" with the intent to defraud, as specified.

CONNECTICUT
H.B. 6981 
Status: 4/24/07 Tabled for the Calendar, House
Amends existing statute to provide the Attorney General with investigatory authority regarding electronic mail phishing and identity theft statutes.

GEORGIA
S.B. 24  
Status: 4/20/07 - House Withdrawn, Recommitted
Prohibits persons from using the Internet or electronic mail to induce another to provide identifying information by falsely representing themselves to be a business without the authority or approval of the business; to provide definitions; to provide for penalties and sanctions; to provide for related matters; to repeal conflicting laws; and for other purposes.

HAWAII
H.B. 1004
Status: 6/15/07 Signed by Governor, Act 183
Restructures the division of consumer advocacy, department of commerce and consumer affairs and appropriates funds for additional operating costs, including additional positions to improve the operations of the division. Appropriates funds to the Office of the Auditor for research and support services necessary to protect Hawaii consumers by developing additional deterrents for identity theft.

S.B. 331
Status: 3/23/07 Passed Second Reading and referred to the committees on Finance
Appropriates funds to the office of the auditor for research and support services necessary to develop additional deterrents for identity theft, and in particular, those related to the compromise of electronic data and information.

ILLINOIS
S.B. 137 
Status: 8/23/07 Signed by Governor, Public Act 95-0350
Creates the Anti-Phishing Act making it illegal to obtain personal information via the Internet.

KENTUCKY
H.B. 7
Status: 3/1/07 To Senate Judiciary
Among other provisions, creates definitions and establishes a Class D felony offense for "phishing," which is using the Internet to induce a person to provide identifying information by representing without authorization that the requester is another person; provides a civil cause of action against a person who "phishes," to allow injunctive relief, damages up to the greater of actual damages or $25,000 for each violation, treble damages in certain circumstances, and reasonable attorney's fees and court costs to a prevailing plaintiff to subject violations to the remedies, powers, and duties of the Consumer Protection Act, and establishes a statute of limitations.

MICHIGAN
S.B. 945
Status: 12/4/07 Referred to Committee on Judiciary
Prohibits obtaining personal information by false pretenses.

MONTANA
H.B. 630
Status: 4/26/07 Signed by Governor, Chapter 276
Provides that fraudulent electronic misrepresentation, “phishing,” is the crime of a theft of identity.

NEW JERSEY
A.B. 763
Status: 1/10/2006 Introduced, Referred to Assembly Telecommunications and Utilities Committee
Expands offense of computer criminal activity to include accessing computer data for an unlawful purpose by means of a knowing misrepresentation as to identity of person requesting information.

A.B. 3382
Status: 6/26/2006 Introduced, Referred to Assembly Consumer Affairs Committee
Establishes the Anti-Phishing Act.

S.B. 2251 
Status: 10/16/2006 Introduced in the Senate, Referred to Senate Commerce Committee
Establishes the Anti-Phishing Act.

NEW YORK
A.B. 646

Status: 1/3/07 To Assembly Committee on Codes
Establishes the crime of obtaining the personal identifying information of another by electronic fraud.

PENNSYLVANIA
H.B. 32
Status: 3/21/07 Re-committed to House Appropriations Committee
Makes phishing a criminal offense.

* Represents only legislation that specifically addresses "phishing."  Additional states may be considering legislation that addresses fraudulent or deceptive actions involving the Internet and e-mail or identity theft legislation that could apply to phishing schemes.