FTC wins $163 million from woman who tricked 1 million users into thinking their PCs had malware

Four years after filing its case, the US Federal Trade Commission (FTC) has finally finished its first legal fight against scareware, including instances with names such as WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus. A federal court has imposed a judgment of more than $163 million on the final defendant, Kristy Ross.

For the uninitiated, scareware is scam software which claims to protect your computer from malware, but really does nothing. It is often marketed to consumers by tricking them via social engineering to cause shock or cause anxiety with the perception of a threat that isn’t really there. Software to “fix” their non-existent problem is then sold to these unsuspecting users.

This particular operation used elaborate and “technologically sophisticated” Internet ads placed with advertising networks on many popular commercial Web sites. The ads displayed a “system scan” to consumers that invariably claimed to detect a host of malware on their computers. The bogus “scans” then urged the victims to buy useless software for $40 to $60 to remove the malware.

In December 2008, the FTC filed a complaint in federal court against Innovative Marketing and ByteHosting Internet Services, as well as individuals Sam Jain, Daniel Sundin, James Reno, Marc D’Souza, and Kristy Ross. The FTC alleged that the defendants violated the FTC Act by deceptively marketing software, falsely representing that scans of consumer computer found they had been compromised or infected, and then offered to sell software to fix the “problems.” The FTC further estimated that the unlawful conduct netted the defendants more than $100 million.

Over the years, the FTC reached settlements with six out of the seven defendants. The remaining defendant, Kristy Ross, has received judgment today. The court has now permanently prohibited her from selling computer security software and any other software that interferes with consumers’ computer use, as well as from “any form of deceptive marketing.” Right, because that last part would be okay otherwise.

Image credit: mokra