Google warns about global ‘smishing’ ring stealing millions via text scams

On Wednesday, Google revealed that it has initiated a lawsuit against an international cybercriminal group responsible for a wave of SMS phishing attacks, commonly known as 'smishing.' Through a detailed blog post, the tech giant outlined how this organization has established a phishing-as-a-service platform dubbed 'Lighthouse,' enabling them to orchestrate extensive phishing campaigns. These deceptive attacks leverage the credibility of well-known brands, such as E-Z Pass, to unlawfully obtain individuals' financial data. Victims receive text messages containing links that prompt them to divulge sensitive information, including their banking details and email credentials. Google has discovered at least 107 fraudulent website templates that misuse its branding, designed to deceive users into thinking these sites are legitimate. The impact of these smishing attacks is significant, with Google estimating that over 1 million individuals across more than 120 countries have fallen victim to the Lighthouse scheme. In the United States alone, it is believed that attackers have compromised between 12.7 million and 115 million credit card numbers. Halimah DeLaine Prado, Google's general counsel, explained to CNBC, "The 'Lighthouse' enterprise creates numerous templates for fake websites aimed at extracting user information." To combat this threat, Google's legal action targets the core infrastructure of the cybercriminals, invoking various legal frameworks, including the Racketeer Influenced and Corrupt Organizations (RICO) Act, the Lanham Act, and the Computer Fraud and Abuse Act. In addition to its legal measures, Google is also rolling out AI-driven features designed to identify and flag common scam messages, such as fraudulent toll-fee alerts and package delivery notifications, to enhance user protection against scams. The company is also enhancing its Google Messages platform to block harmful links and fraudulent schemes. For victims of account compromises, Google aims to simplify the recovery process by expanding options with new Recovery Contacts. Furthermore, the tech giant is ramping up public education and partnership initiatives to help users recognize and avoid scams. In its blog post, Google expressed hope that these proactive steps will contribute to a safer online experience for users everywhere. Additionally, the company is collaborating with lawmakers and has expressed support for several bipartisan bills currently under consideration in the U.S. Congress.