This section makes phishing a crime when someone uses the internet to trick another person into giving identifying information by pretending to be a business without that business’s authority.
(a) A person commits the crime of phishing if the person by means of an Internet web page, electronic mail message, or otherwise using the Internet, solicits, requests, or takes any action to induce another person to provide identifying information by representing that the person, either directly or by implication, is a business, without the authority or approval of the business. (b) Any person violating this section, upon conviction, shall be guilty of a Class C felony. Multiple violations resulting from a single action or act shall constitute one violation for the purposes of this section. (c) The following persons may bring an action against a person who violates or is in violation of this section: (1) A person who is engaged in the business of providing Internet access service to the public, owns a web page, or owns a trademark, and is adversely affected by a violation of this section. (2) An individual who is adversely affected by a violation of this section. (d) In any criminal proceeding brought pursuant to this section, the crime shall be considered to be committed in any county in which any part of the crime took place, regardless of whether the defendant was ever actually present in that county, or in the county of residence of the person who is the subject of the identification documents or identifying information. (e) The Attorney General or the district attorney may file a civil action in circuit court to enforce this section and to enjoin further violations of this section. The Attorney General or the district attorney may recover actual damages or twenty-five thousand dollars ($25,000), whichever is greater, for each violation of subsection (a). (f) In a civil action under subsection (e), the court may increase the damage award to an amount equal to not more than three times the award provided in subsection (d) if the court determines that the defendant has engaged in a pattern and practice of violating subsection (a). (g) Proceeds from an action under subsection (e) shall first be used for payment of all proper expenses, including court costs, of the proceedings for the civil action with the remaining proceeds payable first towards the restitution of any victims, as determined by the court. Any remaining proceeds shall be awarded equally between the State General Fund and the office of the Attorney General, the office of the district attorney bringing the action, or both. (h) An interactive computer service provider shall not be held liable or found in violation of this section for identifying, removing, or disabling access to an Internet web page or other online location that such provider reasonably believes by clear and convincing evidence that it is being used to engage in a violation of this section.