Wintry mix spreads across Minnesota

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

If you have a mobile phone, you have no doubt seen some dodgy texts.

They might declare that you have an overdue road toll, and urge you to "Click here to pay." Or maybe they inform you that there's a package waiting, but the address is wrong; "Click here to fix it."

More often than not, these texts are scams. The websites you are directed to are fakes, often decked out with a misappropriated Google logo to trick you into typing in sensitive payment or sign-in information. It's called a "phishing" attack — or "smishing" when it's done via SMS.

On Wednesday, the tech giant went on the offensive, filing a lawsuit with the U.S. District Court in the Southern District of New York targeting what it alleges is a sprawling criminal organization based in China called "Lighthouse" that provides software and support to online scammers.

The lawsuit alleges that the Lighthouse network runs a "Phishing-as-a-Service" operation, selling a software kit that offers hundreds of fake website templates to would-be scammers. Google's suit says nearly 200 of them have mimicked U.S.-based sites, including New York City's official website, the post office and the West Virginia DMV.

Halimah DeLaine Prado, Google's general counsel, said over 100 of the templates to make fake websites

have included the company's logos in places where people were directed to sign in or make payments, creating the illusion of legitimacy. "We are a global company. This hits all of our users," she said. "We're concerned about the damage to user trust and not knowing what websites are safe."

The Lighthouse network has targeted victims in more than 120 countries, swindling millions of dollars from victims each year, the suit alleges.

Screenshots included in the complaint show that the network apparently misused several other well-known logos, including those of payment, credit card and social media companies.

DeLaine Prado declined to put a dollar figure on the damage to Google, saying it was "a bit immeasurable," but noted a stark example of what Google believes to be the reach of the organization. From July 2023 through October 2024, according to the complaint, the Lighthouse network created or used 32,094 distinct phishing websites that mimicked the U.S. Postal Service. DeLaine Prado estimated those sites would "compromise between 12.7 and 115 million credit cards in the U.S. alone."

But there's a twist: Google doesn't know the actual identities of the people it's trying to sue. The suit refers to the defendants as "Does 1-25" — as in John or Jane Doe. Rather than names, the court filing contains only handles that some of those individuals have used on the encrypted messaging app Telegram to do business. 

Plus, they're in China, beyond the reach of U.S. courts.

NPR sought comment by messaging several of the Telegram handles that the court filing said were involved in the Lighthouse enterprise. Most did not reply. "Kun Lun," identified in Google's filing as part of the team within the Lighthouse enterprise that helped send out spam texts, said: "What does this have to do with me? I'm not familiar with this." 

The primary goal isn't to bring any of these people to trial, DeLaine Prado said. "The goal is deterrence."

In filing the case, she said, Google is seeking a declaratory judgment from the court ruling that Lighthouse's activity is illegal.

"It allows us a legal basis on which to go to other platforms and services and ask for their assistance in taking down different components of this particular illegal infrastructure," she said, without naming which platforms or services Google might focus on.

"Even if we can't get to the individuals, the idea is to deter the overall infrastructure in some cases."

She said the lawsuit would also help let consumers know to be vigilant about scams.

DeLaine Prado said going after scammers is her legal team's "bread and butter," and that while this case is large, it is not unique. "In terms of litigation, we look for cases where we really think it is ripe for public attention and the investigation yields something where the court can actually help be a shield to protect users," she said.

Google on Wednesday also publicly endorsed three bipartisan bills being considered by Congress that are meant to help law enforcement agencies target scammers. The bills include the 

Guarding Unprotected Aging Retirees from Deception (GUARD) Act

, which would allow local law enforcement to use grant funding to investigate financial fraud targeting retirees; the 

, which would establish a task force to block foreign robocalls; and the 

Scam Compound Accountability and Mobilization (SCAM) Act

, which aims to develop a national strategy to counter "compounds" where people are trafficked to work in scam operations.

The case comes at a challenging time for Google, which is facing its own legal difficulties.

 the company to share search data with some of its competitors.

The penalty was based on a previous ruling after the court found the company held an illegal monopoly in its core internet search business. This month, another court 

 that Google's digital advertising practices violate antitrust laws. And last week, Google 

 with Epic Games to end yet another antitrust lawsuit, focused on its Play app store.

Business and Economic News

Homepage

John Ruwitch

Author

Ever gotten a text saying you forgot to pay a nonexistent road toll or need to pick up a mystery package? Google's going after the scammers behind those messages.

Google launches a lawsuit targeting text message scammers

Go Deeper.

Like this?

News you can use in your inbox