Plenty of laws exist to prosecute online identity thieves and fraudsters, and also to co-opt Internet Service Providers (ISPs) and online auction sites into the fight against fraud, but enforcement is lacking across the board, according to security experts.
"Most countries have laws that adequately address Internet fraud," vice-president of consulting and technical services firm Stroz Friedberg, Paul Luehr, said. "We lack the technical skills to track down these people, and we lack the means of effectively collaborating on investigations across national boundaries."
The Internet community worldwide has recently seen an upsurge in phishing scams, or online exploits of people attempting to steal sensitive information such as a password, bank account or credit card number, often under the guise of updating account information.
For example, the Nigerian 419 or advance fee fraud continues to take victims. A UK man was jailed recently for six years for defrauding his own employers in order to raise money to use in a fake bank transfer scheme.
Meanwhile, Australian online betting sites have been targeted by Russian extortion gangs, who have flooded the sites with traffic, effectively closing them down, after they refused to pay protection money of $US20,000.
And online auction sites are now routinely targeted for cheque fraud, where a buyer pays for goods with a fake cheque which is not discovered until the goods have been shipped.
"One of the major issues is that a lot of these crimes are perpetrated by individuals outside of the US and in countries where law enforcement does not have a cooperation with ISPs," chief security architect of Secure Data in Motion's Sigaba business unit, Jahan Moreh, said. "That is why we are a major proponent of educating people by making them aware of the issues and what they should watch for."
Yet, inside the US, there are several laws which could be applied to online fraudsters, according to Luehr.
Phishing could be prosecuted under laws relating to identity theft, credit, hacking, mail fraud, wire fraud, releasing viruses and spamming.
The wire fraud statute alone could carry a penalty of 30 years in prison and a fine of $US1 million if a bank was affected, Luehr said.
The setting up of fake bank websites, which have become an integral part of the 419 fraud, violates US criminal and civil laws that prohibit fraud, deceptive advertising, unregulated banking and the sale of unregistered securities.
The Securities and Exchange Commission (SEC) has prosecuted dozens of cases of these types, Luehr said.
According to Internet anti-fraud watchdog groups, ways of attacking bank frauds at their source include ISPs boosting their security, or at least closing down fake bank websites and shutting email accounts of known fraudsters. But this relies on the good will of the ISP, which is not always forthcoming.
"Organisations have both the means and the methods to take strong security measures to protect customers and consumers by using technology," Sigaba's Moreh said. "[But] the requirements for privacy protection are in direct conflict with the requirements of security."
Luehr said, major ISPs such as Microsoft's MSN, Yahoo, America Online and Earthlink had a public reputation to uphold and so worked closely with law enforcement to shut down fraudsters using their systems. Conversely, smaller ISPs had an active interest in ignoring suspect practices on their services, from a legal as well as a financial perspective.
"ISPs and hosters can be held liable for 'aiding and abetting' a law violation or for providing the 'means and instrumentalities' of fraud," he said. "However, prosecutors and civil litigants must prove they acted with some level of guilty knowledge before holding them liable. That means that smaller ISPs and Web hosters have a tendency to avoid any guilty knowledge by burying their heads in the sand."
An ISP which closed a site down could be sued for breach of contract and tortious interference with a business relationship, Luehr said.
However, he thought the general public would probably always use an open network.
"Trust will be built through 'gated communities' such as Virtual Private Networks [VPNs], private chatrooms or through encrypted transactions that use digital certificates or biometrics," Luehr said.
Apart from the negligible international cooperation and the lack of technical skills, a failure to clearly understand the nature of online fraud is hampering progress.
"Cybercrime is the third-highest priority of the FBI behind fighting terrorism and foreign espionage," Luehr said. "In practice, however, Internet fraud cases sometimes fall between the cracks because they are not as sophisticated or as urgent as cyberterrorism or hacking cases.
"I believe the [political] will is there but there is a lack of understanding of the issues," Moreh said. "[Politicians] try to approach these types of fraud as they would traditional, non-cyber-related fraud."
There seems to be no immediate prospect that technology or law enforcement can stem the flood of online frauds as the open nature of the Internet, which was chiefly responsible for its explosive growth, provides such an ideal ground for people who want to exploit it. Consumer education has also proved ineffective, as the increasing number of victims going public shows. The 419 fraud alone is believed to have garnered $US5 billion from victims over the last six years. Fraud complaints by US consumers against foreign companies have risen from 4968 in 1999 to 34,882 in 2003, according to the US Federal Trade Commission's Consumer Sentinel.
Although the initiative lay with the online criminals, attempts to wrest back the Internet for the purposes it was originally designed for had not been abandoned, Luehr said.
"Online fraud and ID theft are definitely crimes that can and should be pursued," he said.