AI Scam Surge Prompts Google to File Lawsuit

Phishing texts that mimic a bank alert or a package delivery notice usually point to a fake website built to capture passwords and card numbers. Google says one criminal network used artificial intelligence to build those websites at a scale no human team could match.

Google has filed a civil lawsuit against that network, a China-based operation it calls Outsider Enterprise, accusing it of using Gemini and other AI models to mass-produce phishing sites. TechCrunch reported that the complaint, filed in Manhattan federal court, ties the network to more than 9,000 fake websites and over 1.5 million fraudulent URLs.

In a Friday (June 12) blog post announcing the lawsuit, Google said during a two-week stretch in May, Android users flagged 55,000 spam texts linked to the operation, generating more than two complaints a minute.

AI Turns Coding Requests Into Phishing Pages

Google’s complaint details how members of Outsider Enterprise allegedly prompted Gemini and other AI platforms with requests framed as ordinary coding tasks. One example cited in the filing asked an AI model to write code for a gift redemption page, then fed that output into Outsider’s software to turn it into a live scam site.

According to the lawsuit, the platform bundled more than 290 prebuilt templates copying banks, telecom carriers, retailers and government agencies.

“For a subscription fee as low as $88 a week, the Outsider ‘phish kit’ allows its users to create fraudulent websites, launch phishing campaigns, and steal victims’ credit card numbers, bank account credentials, and personal data,” according to Google’s complaint.

To reach victims, members of the network allegedly sent text messages impersonating Google, YouTube, the Postal Service and other brands. The messages directed recipients to the AI-generated sites, where victims entered passwords, card numbers and other personal data, according to the complaint.

A Criminal Network Organized Like a Business

Google’s complaint described Outsider Enterprise as a set of coordinated groups rather than a single operation. One group allegedly builds and maintains the phishing software and templates, while another supplies lists of targets drawn from public records, social media and past data breaches. A third group runs the SIM cards and modems used to send scam texts in bulk. A fourth group monetizes stolen credentials and launders the proceeds. Google said participants discuss strategy and train each other openly through Telegram channels.

The financial scale is large. TechCrunch reported that the FBI said Outsider Enterprise’s phishing platform has enabled the theft of at least 3.87 million credit card numbers and about $1.9 billion in losses since July 2023.

Google said the recent campaign alone scammed hundreds of thousands of victims, with losses estimated in the millions.

An earlier version of the Outsider software was tied to the theft of at least 36,000 payment cards issued by banks in 95 countries, according to Google’s complaint. That earlier activity predates the AI-assisted version of the platform now at the center of the lawsuit.

Carriers and Lawmakers

Google said it is coordinating with the FBI on law enforcement actions, and working with AT&T, T-Mobile and Verizon to block the scam texts before they reach phones. Google said its own detection systems already intercept more than 10 billion malicious messages a month.

TechCrunch reported that the FBI, working with Google and Lumen’s Black Lotus Labs, seized domains and Shopify storefronts the network used to test its phishing service, along with a Telegram bot the network used to sell software subscriptions.

The complaint also accuses the network of hosting phishing pages on Google Cloud and Google Drive and of copying Google’s trademarks to make scam sites look legitimate.

According to its blog post, Google is advocating for federal legislation aimed at coordinating responses to AI-enabled scams, including bills from Reps. Brian Fitzpatrick and Josh Harder that would direct law enforcement, government and industry to work together against organized scam networks.

The lawsuit accuses Outsider Enterprise of racketeering, trademark infringement, wire fraud and false advertising, and asks the court for an injunction and damages.