That text message you got about a 'stuck package' from USPS or an 'unpaid road toll'? It’s not just spam. It’s the calling card of a sophisticated, global scam that has swindled victims out of millions of dollars.

Today, we're fighting back. We are filing litigation to dismantle "Lighthouse," a massive Phishing-as-a-Service operation, and we're also endorsing pivotal bipartisan bills in the U.S. Congress to protect everyone from these attacks.

Disrupting a Phishing-as-a-Service enterprise

Bad actors built "Lighthouse" as a phishing-as-a-service kit to generate and deploy massive "smishing" (SMS phishing) attacks. These attacks exploit established brands like E-Z Pass to steal people’s financial information.

The scam is simple: criminals send a text message, prompting recipients to click a link and share information such as email credentials, banking information and more. They exploit the reputations of Google and other brands by illegally displaying our trademarks and services on fraudulent websites. We found at least 107 website templates featuring Google's branding on sign-in screens specifically designed to trick people into believing the sites are legitimate.

These crimes are inflicting immense financial harm globally. "Lighthouse" has harmed over 1 million victims across more than 120 countries, stealing somewhere between 12.7 million and 115 million credit cards in the U.S. alone. This represents a five-fold increase in these types of attacks since 2020.

Our legal action is designed to dismantle the core infrastructure of this operation. We are bringing claims under the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act, and the Computer Fraud and Abuse Act to shut it down, protecting users and other brands.

Strengthening defenses through policy

Legal action can address a single operation; robust public policy can address the broader threat of scams. We are collaborating with policymakers and are today announcing our endorsement of key bipartisan bills in the U.S. Congress. We encourage Congress to enact these crucial bills and help bring a decisive end to the financial harm and damage wrought by foreign cybercriminals.

• Guarding Unprotected Aging Retirees from Deception (GUARD) Act sponsored by Sens. Britt (AL), Scott (FL), Gillibrand (NY) and Reps. Nunn (IA-03), Fitzgerald (WI-05), and Gottheimer (NJ-05): This legislation would empower state and local law enforcement by enabling them to utilize federal grant funding to investigate financial fraud and scams specifically targeting retirees.
• Foreign Robocall Elimination Act sponsored by Sens. Budd (NC) and Welch (VT): This legislation would establish a taskforce focused on how to best block foreign-originated illegal robocalls before they ever reach American consumers.
• Scam Compound Accountability and Mobilization (SCAM) Act sponsored by Sens. Cornyn (TX) and Shaheen (NH): This legislation would develop a national strategy to counter scam compounds, enhance sanctions and support survivors of human trafficking within these compounds.

Beyond taking legal action and supporting policies that protect people, we are also launching new features like using AI to flag common scam messages like fake toll fees or package deliveries. We’re also protecting people from malicious links and scams in Google Messages. And if you are the victim of an account compromise, we’re making it safer and easier to regain access to your account by expanding account recovery options with Recovery Contacts. We also continue to intensify public education and partnership efforts to help users recognize and avoid fraud. We hope these efforts will help more people be safe online.

From the courtroom to the Capitol, we are taking action to stop these attacks. But this is a shared fight. While we take on criminal networks and advocate for stronger laws, we are also building smarter, AI-driven tools to help you spot and avoid these scams. Together, we can make the digital world a much harder place for criminals to do business.