Google Lawsuit Accuses China-Based Cybercriminals of Massive Text Message Phishing Scams

Google is filing a federal lawsuit against a network of foreign cybercriminals based in China, accused of launching massive phishing attacks via text messages, the tech giant told News themezone in an exclusive interview.

Google said the messages are part of a criminal network called “Lighthouse.” The texts appear legitimate and often warn recipients about a “package stuck” or a “unpaid toll,” but in reality they are phishing or what is called smishing, a type of phishing scam that uses text messages to try to trick recipients into revealing personal and sensitive information, such as passwords and credit card numbers, which are then stolen.

“These scammers ended up compromising from 15 [million] to 100 million potential credit cards within the US and affected, according to our current estimates, more than one million victims,” ​​Google general counsel Halimah DeLaine Prado told News themezone.

DeLaine Prado said Google has filed what it calls a lawsuit, the first of its kind, under the RICO Act, which is typically used to crack down on organized crime networks.

The case targets unknown operators, listed as John Does 1 through 25, who allegedly created a “phishing-as-a-service” platform to power mass text attacks.

DeLaine Prado said the lawsuit is not specifically intended to help victims recover losses, but rather to serve as a “deterrent to future criminals creating similar businesses.”

Google said it found more than 100 fake sites that used its logo to trick people into handing over passwords or credit card numbers. According to his complaint, he estimates that the group has stolen confidential information linked to tens of millions of credit cards in the United States alone.

Kevin Gosschalk, CEO of cybersecurity firm Arkose Labs, said that while recovering lost money is a challenge, lawsuits like Google’s could help disrupt scammers’ operations.

“It has an impact on the ecosystem,” Gosschalk told News themezone. He said that if there are three big players and you go after the big one and eliminate him, “then the other two start to doubt: ‘Hey, should we be in this business or should we get out of this business?'”

Google’s move appears aimed at both setting a legal precedent and seeking punishment: testing whether an organized crime law from the 1970s can be applied to a 21st century digital crime.

Gosschalk said it will be very difficult for Google to pursue cybercriminals abroad, as many of them also operate in countries like Cambodia, where there are limited extradition laws.

“But it does mean that the people behind those things will not be able to travel to the United States in the future, so it adds an additional risk,” Gosschalk said.

Users can avoid text message scams by not clicking on links or responding to unknown messages. On an iPhone, users can turn on “Filter Unknown Senders” and “Filter Junk.” On Android, enable spam protection and forward scam text messages to 7726 (SPAM).

Note that those filters may also detect legitimate messages from numbers that are not in the phone’s contact list, so be sure to check the unknown senders or spam folder from time to time.