§ 390-B — Anti-phishing act of 2006

§ 390-b. Anti-phishing act of 2006. 1. This section shall be known as\nand may be cited as the "anti-phishing act of 2006".\n 2. For purposes of this section, the following terms shall have the\nfollowing meanings:\n (a) The term "electronic message" means a message sent or posted to a\nunique destination, commonly expressed as a string of characters,\nconsisting of a unique user name or mailbox (commonly referred to as the\n"local part") and a reference to an internet domain (commonly referred\nto as the "domain part"), whether or not displayed, to which an\nelectronic message can be sent, delivered or posted.\n (b) The term "identifying information" means an individual's (1)\nsocial security number; (2) driver's license number; (3) bank account\nnumber; (4) credit or debit card number; (5) personal identification\nnumber (PIN); (6) automated or electronic signature; (7) unique\nbiometric data; (8) account passwords; or (9) any other piece of\ninformation that can be used to access an individual's financial\naccounts or to obtain goods or services.\n (c) The term "internet" means collectively the myriad of computer and\ntelecommunications facilities, including equipment and operating\nsoftware, which comprise the interconnected world-wide network of\nnetworks that employ the transmission control protocol/internet\nprotocol, or any predecessor or successor protocols to such protocol, to\ncommunicate information of all kinds by wire or radio.\n (d) The term "web page" means a location, with respect to the world\nwide web, that has a single uniform resource locator or other single\nlocation with respect to the internet.\n 3. It is unlawful for any person, by means of a web page, electronic\nmessage, or other use of the internet to solicit, request or collect\nidentifying information by deceptively representing himself or herself,\neither directly or by implication, to be a business or a governmental\nentity and doing so without the authority or approval of such business\nor such governmental entity.\n 4. (a) The attorney general, or any person who either is engaged in\nthe business of providing internet access service to the public or owns\na web page or trademark and who is adversely affected by reason of a\nviolation of the provisions of subdivision three of this section, may\nbring an action against a person who violates the provisions of\nsubdivision three of this section:\n (1) to enjoin further violation of the provisions of subdivision three\nof this section; and\n (2) to recover the greater of:\n (A) actual damages; or\n (B) one thousand dollars for each instance in which identifying\ninformation is solicited, requested or collected from a person in\nviolation of the provisions of subdivision three of this section.\n (b) In an action under paragraph (a) of this subdivision, a court may:\n (1) increase the damages up to three times the damages allowed by\nparagraph (a) of this subdivision where the defendant has been found to\nhave engaged in a pattern and practice of violating the provisions of\nsubdivision three of this section; and\n (2) award costs and reasonable attorney's fees to a prevailing party.\n 5. Nothing in this section shall in any way limit rights or remedies\nwhich are otherwise available under law to the attorney general or any\nother person authorized to bring an action under subdivision four of\nthis section.\n