How should I deal with a social hacker?

[Jayce]

I work for a company that has a large number of customers. Some of those customers have been complaining about someone hijacking customer accounts and selling the login information on the black market.

This login information contains data that is confidential in nature, such as credit card numbers, email addresses, mailing addresses, and other equally valuable things.

During a support session where I was helping a customer regain control of their account, I stumbled upon a link to the person who was "phishing" for the information on accounts. This wasn't just a possible link, but a definite link. I counted over 200 separate cases of fraud and documented each one in great depth for our legal department to investigate.

I have a huge amount of this person's contact information, where they live, and so on and I feel an overwhelming desire to cause them an ounce of the frustration they've caused to over 200 people, including myself.

Without doing something illegal, what should I do?

[the_synista]

Contact the authorities and ask them.
The person's ISP should also have an "abuse" e-mail where you can contact them, but all that will do is maybe have them send him a warning, or cut his service off.
Or try this;
http://www.usa.gov/Citizen/Topics/Internet_Fraud.shtml

[Leemo]

Three letters:


F B I

[ray_8128]

FBI : Internet Fraud
http://www.fbi.gov/majcases/fraud/internetschemes.htm

Reporting Computer, Internet-Related, or Intellectual Property Crime
http://www.usdoj.gov/criminal/cybercrime/reporting.htm

The Internet Crime Complaint Center
http://www.ic3.gov/about/

[mrgone2a]

Let the legal department handle it.

[Tj]

Make witty jokes in conversation? Throw a big party for him/her?
You don't seem to elaborate on your socially talented individual.
See: http://en.wikipedia.org/wiki/Hacker_defi...ontroversy

As for the identity theft, fraud and other bad behavior by a cracker, the suggestion of the FBI would seem most advisable.
If any restitution comes of it, share it with those customers affected.
Additionally, try to provide at least some kind of education for your customers about Social Engineering. http://en.wikipedia.org/wiki/Social_engi..._security)
This may require some policy changes in the computer security and/or customer relations department.