Congress passes pretexting law.

Pretexting--the act of impersonating an individual to obtain their telephone and other personal records without their consent--is now a federal crime in the United States.

In late 2006, Congress enacted legislation--the Telephone Records and Privacy Protection Act of 2006--criminalizing pretexting and imposing a 10-year prison sentence and fines of up to $500,000 on offenders who trick phone companies into divulging the records and personal information of their customers. In special circumstances, such as crimes involving violence, the law allows for larger penalties, media sources reported. The law also prohibits providing false or fraudulent documents to a telecommunications or IP-enabled voice service provider and accessing customer accounts via the Internet or by fraudulent computer-related activities without authorization.

Before Congress passed the federal pretexting law, only about 12 states had legislation that addressed the crime.

[ILLUSTRATION OMITTED]

Some security experts called the new legislation a good first step. But most consumer and privacy advocates said the bill does not go far enough to protect individuals.

For example, the law contains an exemption for law enforcement that could allow them to hire investigators to obtain individuals' phone records, The New York Times reported. Also, there is nothing in the legislation that requires companies to protect their customers' personal information--something that privacy advocates have been demanding for years. The measure also does not give the Federal Trade Commission the power to issue civil fines or pursue firms that trade illicitly in consumer telephone records.

The Times said consumer advocates plan to propose broader legislation to Congress in 2007 that would make it illegal to try to fraudulently obtain other kinds of personal data, including utility, television, and Internet service provider records.

Although the new legislation may fall short in fully protecting consumers, businesses worried about falling prey to pretexters can take a few steps to protect themselves, according to a report by Esther Shein in the December 2006 issue of CFO magazine. She suggests that businesses

* Issue pre-paid cell phones. Prepaid service providers typically do not record calls or keep phone logs, so there are no records for pretexters to access.

* Instruct company phone service providers not to give out any information without written authorization and require company credit card, utility, and phone services to send records via regular mail.

* Train all employees who handle incoming information requests so they can route calls correctly, thereby reducing pretexters' ability to elicit information from unwitting staff members.