Google launches a lawsuit targeting text message scammers : NPR

If you have a mobile phone, you have probably seen some suspicious messages.

They may announce that you are overdue on your toll and advise you to “Click here to pay.” Or maybe you are told that a package is waiting, but the address is incorrect; “Click here to fix it.”

Most often these messages are fraudulent. The websites you are redirected to are fake, often emblazoned with a misappropriated Google logo to trick you into entering sensitive payment or login information. This is called a “phishing” attack – or “smishing” when carried out via SMS.

And now Google has dealt with the scammers.

The tech giant went on the offensive Wednesday, filing a lawsuit in the U.S. District Court for the Southern District of New York against what it claims is a sprawling criminal organization based in China called Beacon, which provides software and support to online scammers.

The lawsuit alleges that the Lighthouse network runs a Phishing-as-a-Service operation, selling a software suite that offers would-be scammers hundreds of fake website templates. Google's lawsuit says about 200 of them imitate American sites, including the official New York City site and the West Virginia Post Office and DMV.

Halima DeLane Prado, Google's general counsel, said more than 100 templates are being used to create fake websites. placed company logos in places where people were asked to log in or make a payment, creating the illusion of legitimacy. “We are a global company. This affects all of our users,” she said. “We are concerned about the damage to user trust and the lack of knowledge about which websites are safe.”

The Lighthouse network targets victims in more than 120 countries, defrauding victims out of millions of dollars each year, the lawsuit alleges. Screenshots included in the complaint show that the network apparently misused several other well-known logos, including those of payment, credit card and social media companies.

DeLane Prado declined to say how much damage Google suffered, saying it was “a little immeasurable,” but noted a clear example of what Google believes is the organization's reach. According to the complaint, from July 2023 to October 2024, the Lighthouse network created or operated 32,094 different phishing websites imitating the United States Postal Service. DeLane Prado estimated that these sites would “put between 12.7 million and 115 million credit cards at risk in the U.S. alone.”

But there's one thing: Google doesn't know the real identities of the people it's trying to sue. The suit refers to the defendants as “Cases 1-25,” as in John or Jane Doe. Instead of names, the court filings contain only aliases that some of these individuals used on the encrypted messaging app Telegram to conduct business.

Moreover, they are in China, out of reach of American courts.

NPR sought comment by sending messages to several Telegram users identified in the court document as being involved in the Lighthouse venture. Most did not answer. “Kun Lun,” listed in Google documents as a member of the Lighthouse enterprise team that helped send the spam messages, said: “What does this have to do with me? I'm not familiar with this.”

DeLaine Prado said the main goal is not to bring any of these people to justice. “The goal is containment.”

According to her, when filing a lawsuit, Google is seeking a declaratory judgment that Lighthouse’s activities are illegal.

“This gives us the legal basis to reach out to other platforms and services and ask for their help in taking down various components of this particular illicit infrastructure,” she said, without saying which platforms or services Google might focus on.

“Even if we can't get to individuals, the idea is to contain the entire infrastructure in some cases.”

She said the lawsuit will also help consumers understand the need to be vigilant about scams.

DeLayne Prado said prosecuting scammers is her legal team's “bread and butter” and that while this case is big, it is not unique. “In terms of litigation, we look for cases that we think really deserve public attention, and the investigation produces results where the court can really help protect users,” she said.

Google on Wednesday also publicly endorsed three bipartisan bills being considered by Congress that would help law enforcement combat scammers. Bills include Protecting Vulnerable Aging Retirees from Fraud Act (GUARD)which would allow local law enforcement agencies to use grant funding to investigate financial fraud targeting retirees; That Foreign Robocall Elimination Actwhich will create a special group to block calls from foreign robots; And SCAM Accountability and Mobilization Actwhich aims to develop a national strategy to combat “communities” where people are trafficked to work in fraudulent operations.

The case comes at a sensitive time for Google, which is facing its own legal challenges.

In September, a federal judge ordered the company shares search data with some of its competitors.

The penalty was based on a previous decision after the court found that the company had an unlawful monopoly in its core Internet search business. Another trial this month rules that Google's digital advertising practices violate antitrust laws. And last week Google agreed to the proposed settlement with Epic Games to end another antitrust lawsuit involving the Play app store.

Google is a financial supporter of NPR.