The scam starts with an e-mail message asking something similar to "Someone you know has a crush on you!  Want to find out who?"  Recipients intrigued enough to find out who might have a "crush" on them are directed to a web site, where they are asked to 'guess' the identity of their admirer by entering e-mail addresses of persons they know until they get a "match." Supposedly, if the person guesses correctly, the identity of the person with the "secret crush" will be revealed.  Unfortunately, instead of finding out the identity of the secret admirer the more likely result is that more of the "Someone you know has a crush on you!" are sent to every e-mail address "guessed" resulting in more and more messages being sent in a never ending (and fruitless) quest to find the identity of the person having the "secret crush."

These "crush" websites are essentially phishing scams which attempt to collect personal information, sometimes of a highly personal nature.  The target audience for these scams is generally the teen age or young adult demographic. Often this highly personal information is sent to the originator of the message (whose identity is often hidden) or sold to others.  Presenting themselves as web sites about dating, crush sites are basically services that collect e-mail addresses as well as highly personal information.  This information can then be used in ways the person tricked into filling out the web form did not intend and would not approve of if they knew the truth about where the information was going to be sent, or how it would be used.  Again, some of these web sites solicit very personal information such as gender and sexual orientation. 

The best defense against this kind of scam is to recognize it and not participate in it.  If you receive an e-mail message or solicitation such as the one described above, simply delete it.  Crush websites are self-perpetuating hoaxes and as a general rule you should never give out someone else's e-mail address without their permission.  In addition, you should not provide personal information about yourself through a web site unless you are certain where the information is going and how it will be used.  Other than a trusted source (such as a known commercial, medical, or educational provider) there's no guarantee who has your personal information or how the information may be used once you click the submit button.

Again, the best policy to follow when receiving this form of e-mail is to delete it immediately.  If you have concerns on the legitimacy contact the person or company represented in the e-mail.  To report the scam you should follow the same contact the Federal Trade Commission or you can forward the e-mail directly to SPAM@UCE.GOV.