An Ohio woman who used forged e-mails from "AOL security" to swindle America Online subscribers out of their credit card numbers was sentenced to 46 months in prison Tuesday, after a federal judge in Virginia rejected her plea for a reduced sentence.

Helen Carr, 55, pleaded guilty last October to one count of conspiracy for her role in a scheme that sent mass e-mails to AOL subscribers purporting to be from the company's security department. According to court records, the messages claimed that AOL's last attempt to bill the recipient's credit card had failed, and included a link to an "AOL Billing Center" web page, where an online form demanded the user's name, address, credit card number, expiration date, three-digit CCV number and credit card limit.

The scheme began to unravel in February, 2001, when Carr unwittingly spammed an off-duty FBI agent with the Norfolk, Virginia field office. The agent, a computer crime specialist, was apparently not taken in by the scam mail, which boasted a return address of "precious44257166@aol.com" and was sent to 19 other AOL users at the same time. The "Billing Center" web page was served by Geocities. "[A] legitimate AOL billing center would not be found at this location," agent Joseph Yuhasz wrote in an affidavit in the case.

By Kevin Poulsen at SecurityFocus.

[ Read more ]