A bill to criminalize Internet scams involving fraudulently obtaining personal information, commonly known as phishing.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Anti-phishing Act of 2004''.

SEC. 2. FINDINGS.

    Congress finds the following:
            (1) American society is increasingly dependent on the 
        Internet for communications, entertainment, commerce, and 
        banking.
            (2) For the Internet to reach its full potential in these 
        and other respects, it must continue to be a trustworthy 
        medium. This means, for example, that Internet users should be 
        able to trust the stated origin of Internet communications and 
        the stated destination of Internet hyperlinks.
            (3) Internet users are increasingly subjected to scams 
        based on misleading or false communications that trick the user 
        into sending money, or trick the user into revealing enough 
        information to enable various forms of identify theft that 
        result in financial loss.
            (4) One class of such scams, called ``phishing'', uses 
        false e-mail return addresses, stolen graphics, stylistic 
        imitation, misleading or disguised hyperlinks, so-called 
        ``social engineering'', and other artifices to trick users into 
        revealing personally identifiable information. After obtaining 
        this information, the ``phisher'' then uses the information to 
        create unlawful identification documents and/or to unlawfully 
        obtain money or property.
            (5) These crimes victimize not only the individuals whose 
        information is stolen, but the entire online community, 
        including millions of people who rely on the integrity of the 
        Internet's system of addresses and hyperlinks.

SEC. 3. CRIMINAL OFFENSE.

    (a) In General.--Chapter 63 of title 18, United States Code, is 
amended by adding at the end the following:
``Sec. 1351. Internet fraud
    ``(a) Website.--Whoever knowingly, with the intent to carry on any 
activity which would be a Federal or State crime of fraud or identity 
theft--
            ``(1) creates or procures the creation of a website or 
        domain name that represents itself as a legitimate online 
        business, without the authority or approval of the registered 
        owner of the actual website or domain name of the legitimate 
        online business; and
            ``(2) uses that website or domain name to induce, request, 
        ask, or solicit any person to transmit, submit, or provide any 
        means of identification to another;
shall be fined under this title or imprisoned up to five years, or 
both.
    ``(b) Messenger.--Whoever knowingly, with the intent to carry on 
any activity which would be a Federal or State crime of fraud or 
identity theft--
            ``(1) falsely represents itself as being sent by a 
        legitimate online business;
            ``(2) includes an Internet information location tool that 
        refers or links users to an online location on the World Wide 
        Web that falsely purports to belong to or be associated with 
        such legitimate online business; and
            ``(3) induces, requests, asks, or solicits a recipient of 
        the electronic mail message directly or indirectly to provide, 
        submit, or relate any means of identification to another;
shall be fined under this title or imprisoned up to five years, or 
both.
    ``(c) Definitions.--In this section:
            ``(1) The term `domain name' has the meaning given that 
        term in section 46 of the Act entitled `An Act to provide for 
        the registration and protection of trade-marks used in 
        commerce, to carry out the provisions of certain international 
        conventions, and for other purposes' (in this subsection 
        referred to as the `Trademark Act of 1946') (15 U.S.C. 1127).
            ``(2) The term `Internet' has the meaning given that term 
        in section 230(f)(1) of the Communications Act of 1934 (47 
        U.S.C. 230(f)(1)).
            ``(3) The term `electronic mail message' has the meaning 
        given that term in section 3 of the CAN-SPAM Act of 2003 (15 
        U.S.C. 7702).
            ``(4) The term `initiate' has the meaning given that term 
        in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702).
            ``(5) The term `procure' means intentionally to pay or 
        provide consideration to, or induce, another person to create a 
        website or domain name.
            ``(6) The term `recipient' has the meaning given that term 
        in section 3 of the CAN-SPAM Act of 2003 (15 U.S.C. 7702).
            ``(7) The term `Internet information location tool' when 
        used in this section has the meaning given that term in section 
        231 of the Communications Act of 1934 (47 U.S.C. 231).
            ``(8) The term `means of identification' when used in this 
        section has the meaning given that term in section 1028 of this 
        title.''.
    (b) Chapter Analysis.--The chapter analysis for chapter 63 of title 
18, United States Code, is amended by adding at the end the following:

        ``1351. Internet fraud''.

Summary: Anti-phishing Act of 2004 - Amends the Federal criminal code to criminalize Internet scams involving fraudulently obtaining personal information (phishing). Imposes a fine or imprisonment for up to five years, or both, for a person who knowingly and with the intent to engage in an activity constituting fraud or identity theft under Federal or State law: (1) creates or procures the creation of a website or domain name that represents itself as a legitimate online business without the authority or approval of the registered owner of such business. And (2) uses that website or domain name to solicit means of identification from any person. Imposes a fine or imprisonment for up to five years, or both, for a person who knowingly and with the intent to engage in activity constituting fraud or identity theft under Federal or State law: (1) falsely represents itself as being sent by a legitimate online business. (2) includes an Internet location tool referring or linking users to an online location on the World Wide Web that falsely purports to belong to or be associated with a legitimate online business, and (3) solicits means of identification from the recipient.