Six men have been charged by a Connecticut grand jury with obtaining private financial information by means of using an online scam, ID theft and financial fraud. Of the six four were from Connecticut and two from Florida. The indictment was actually returned last week, on September 20, but made public this Wednesday, after three of the men pleaded guilty.

The investigation of this alleged phishing ring focused on their campaign that lasted for two years since 2004. The group is believed to have harvested many thousands of AOL email addresses and made mass mailings of phishing emails. Another method was to send victims fake greeting cards in order to surreptitiously infect their computers with malware, which impeded users to connect to AOL and demanded their financial details to continue logging in. It is thought that over the two years the group managed to defraud many thousands of victims and used the money stolen to purchase electronic goods or gift vouchers. However, according to the prosecutors from August 2004 the operation became more sophisticated, as the group started making fake bank cards using the information obtained from their criminal activities. These cards were then used to siphon off funds from the accounts of victims in Florida and Connecticut.

Prosecutors believe that most victims, if not all were users of AOL, but there is a possibility that the criminal ring also defrauded others in this way. US ISP EarthLink helped law enforcement authorities to carry out the investigation into this phishing operation. The company’s abuse team had been unravelling the group since 2005. All data obtained from this investigation by the provider was then given over to law enforcement, including information on the origins of the phishing emails. The three men who pleaded guilty could now face between two and nine and a half years in prison. Sentencing has been scheduled for December this year.