As RFC says in http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4:

403 Forbidden
(...) If the server does not wish to make this information available to the
client, the status code 404 (Not Found) can be used instead.