How Google Is Fighting To End Text Message Scams

Google is going to court to help put an end to, or at least limit, the prevalence of phishing scams over text message. Scam texts have been a nuisance for a long time, but they’ve become increasingly common in recent years. Whether it’s a fake text about a missed toll road payment or an alert about a package delivered to the wrong address, scammers are constantly preying on unsuspecting users with clever phishing attempts.

Consequently, Google this week announced that it filed a lawsuit designed to bring down a company responsible for a large volume of texting scams. Specifically, Google said it’s bringing suit against Lighthouse, an impressively large operation that allegedly provides tools customers can buy to set up their own specialized phishing scams. All told, Google estimates that Lighthouse-affiliated scams in the U.S. have stolen anywhere between 12.7 million and 115 million credit cards.

“Bad actors built Lighthouse as a phishing-as-a-service kit to generate and deploy massive SMS phishing attacks,” Google notes. “These attacks exploit established brands like E-Z Pass to steal people’s financial information.”

Google’s legal action is comprehensive and is intent on completely dismantling Lighthouse’s operations. The search giant is bringing claims under RICO, the Lanham Act, and the Computer Fraud and Abuse Act (CFAA). 

RICO, which often comes up in movies and television shows, allows authorities to treat Lighthouse’s phishing operation as a broad criminal enterprise as opposed to isolated scams. By using RICO, Google also expands the list of individuals who can be found liable, whether it be the people who started Lighthouse, the people who run it, or even unaffiliated customers who used the company’s services.

The Lanham Act, for those unaware, targets malicious actors who misappropriate well-known company trademarks in order to confuse consumers. This Lanham Act comes into play because many phishing scams masquerade as legitimate messages from companies like Amazon and FedEx. The Computer Fraud and Abuse Act, meanwhile, is relevant because scammers typically use stolen credentials to gain unauthorized access to financial systems, something the CFAA is designed to target. Notably, the CFAA is one of the more widely used laws to combat hacking.

The fact that Google is invoking all three of the acts above underscores how serious the company is about putting a stop to SMS-based scams. By using all three, Google’s legal attack is more potent and also expands the range of available remedies to include civil damages and criminal penalties. In short, Google isn’t merely trying to win a legal case; it’s aiming to emphatically and permanently stop Lighthouse in its tracks.

While Google’s lawsuit is reactive, the company is also taking a proactive approach to the extent that it’s working with lawmakers to help pass bills that would make it harder for operations like Lighthouse to succeed in the first place. Beyond protecting its own user base, Google is trying to strengthen legal protections across the board. As noted in its press release, Google is encouraging Congress to pass a trio of bills.

The first is the GUARD Act, a bill that would enable state and local law enforcement agencies to use federal funding to investigate fraud which specifically targets senior citizens and retirees. Indeed, the FBI reports that millions of elderly Americans fall victim to some type of financial fraud every single year. In a shocking figure, elder fraud results in more than $3 billion in losses every single year.

The second is the Foreign Robocall Elimination Act, a bill designed to come up with ways to block “foreign-originated illegal robocalls before they ever reach American consumers.” Finally, Google is trying to convince lawmakers to pass the Scam Compound Accountability Acted Mobilization (SCAM) Act. The SCAM Act is designed to help officials identify and dismantle compounds where large-scale scams operate. The bill also includes measures to support victims of human trafficking who are sometimes found within these compounds.

As scammers become more clever and sophisticated, trying to decipher what type of messages are real or fake becomes much more challenging. To aid in this endeavor, Google is increasingly relying on AI to help users stay safe. Back in March, for example, Google announced two new AI-powered scam detection tools designed to thwart scams that come via text or phone calls.

With respect to messages, Google’s scam detection software can detect suspicious messages in real-time and alert users when a text is likely a scam. Google notes that its software detects suspicious patterns “in SMS, MMS, and RCS messages” and is bolstered by coordination with financial institutions so that it can “better understand the latest advanced and most common scams their customers are facing.” This is crucial, especially now that text-based scams are becoming increasingly conversational due to AI software like ChatGPT.

All in all, it’s encouraging to see Google take such a serious legal stance against Lighthouse. Google’s aggressive approach also helps illustrate how pervasive and lucrative texting scams have become. In the last few years, for example, experts estimate that cybergangs who run text-based scams have earned over $1 billion. Ideally, Google’s lawsuit will not only help stifle current scam operations, but also discourage other bad actors from entering the business in the first place.