Washington (CNN) -- It could happen to anyone who shops online these days.
When buying movie tickets or plane tickets or other regular items and services via computer, a small box appears near the end of the transaction asking if you want to get $10 back on the purchase.
Of course you do. So you click it, launching a secret journey to membership in an online club that can cost $20 every month. With the way the process works, you'd never be aware that you had agreed to a new, ongoing financial relationship with an unfamiliar company -- until you read your credit-card statement a month or two later.
The Senate Commerce Committee held a hearing Tuesday on the marketing practice known to millions of consumers who have fought back to end debit or credit card charges they never authorized.
"It's shocking that they could basically sell my credit card information to an unknown company," witness Linda Lindquist of Sussex, Wisconsin, told the panel.
The controversial practice has involved 30 million consumers and generated more than $1 billion in revenue for participating online marketing companies, said a committee report on the matter.
According to the committee report, the marketing practice is designed to charge consumers without their knowledge.
The marketing companies contract with reputable Web sites to allow their marketing banners and prompts to appear at the end of the sale process, with payments to the host site for every consumer that eventually signs up for a club membership, the report said. That is known as a "bounty."
The consumer's credit card information is automatically transferred to the marketing company, allowing them to charge the monthly marketing fee, the report said. That is called a "data pass."
Expert witnesses told the committee that fine print routinely ignored by consumers often provides legal protection for the marketing companies by stating credit or debit card details will be transferred and subsequent charges will apply.
That's not enough for Sen. Jay Rockefeller, D-West Virginia, the committee chairman who convened the hearing.
"Just because you say it's legal doesn't make it right," Rockefeller said.
Three companies cited in the committee report for such practices provided statements to CNN that said they recently took voluntary steps to change the controversial practices.
The companies -- WebLoyalty.com, Vertrue Incorporated and its affiliate Adaptive Marketing LLC, and Affinion Group -- said they now require consumers to provide the last four digits of their account number or debit or credit card number to authorize additional charges for club memberships and other benefits.
All also said they now provide clear guidelines for consumers on signing up for memberships, charges they will face and other matters. The new policies were announced in the past week by Vertrue and Affinion, and in August by Webloyalty.com.
However, Professor Prentiss Cox of the University of Minnesota Law School, who is a former state regulator in Minnesota, told the committee that changing how the practice occurs won't solve the problem.
"The civil enforcement problem here is that this thing is ... rotten to its core," Cox said, adding that stopping the harmful practices involves more than "separating good operators from bad operators."
The end result is "always" that virtually all consumers involved get charged for something they didn't knowingly purchase or request, he said.
Sen. Byron Dorgan, D-North Dakota, warned that Congress could go after the reputable Web sites that host the controversial operators.
"You better be finding out who's using your Web page, and you certainly better find out who you're providing customer information to," Dorgan said.