Google has filed a lawsuit against the people it says run Lighthouse, a service that sells ready-made kits for sending scam text messages about parcels, road tolls and unpaid fees. According to Google, the operation has reached over 1 million victims in more than 120 countries. The case matters well beyond the courtroom, because the texts it describes are the same ones many of us receive every week.
What happened
On 12 November 2025, Google announced legal action against the operators of Lighthouse, which it describes as a “phishing-as-a-service kit to generate and deploy massive ‘smishing’ (SMS phishing) attacks.” Smishing is simply phishing by text message: a short, urgent message with a link that leads to a fake page asking for your card details.
The Register reports that the suit targets 25 unnamed individuals that the complaint describes as based in China. Google is relying on three US laws: the Racketeer Influenced and Corrupt Organizations Act (RICO), which is normally used against organized crime, the Lanham Act, which covers trademarks, and the Computer Fraud and Abuse Act.
The “as-a-service” part is what caught my attention. The people behind a kit like this do not need to send every message themselves. They build the tooling, then rent it to others who run their own campaigns. That is how you get scale: The Register says more than 200,000 fraudulent websites were created in a 20-day period.
Google paired the lawsuit with support for three bipartisan bills in the US Congress: the GUARD Act, the Foreign Robocall Elimination Act and the SCAM Act.
Who is affected
Anyone with a phone number. The lures described in this case are the familiar ones: a parcel that could not be delivered, a toll you supposedly forgot to pay, a small fee you need to settle today. The fake pages often copy well-known brands so they look believable at a glance.
Google estimates that between 12.7 million and 115 million US credit cards were stolen. That range is very wide, which tells you how hard it is to measure this kind of fraud, but even the low end is enormous.
The victims are not only in the United States. Google counts victims in more than 120 countries, and fake delivery and fee messages are common in Arabic-speaking countries too. If you have ever received a text about a parcel you were not expecting, you have probably seen this type of scam.
By the numbers
| Item | Figure | Source |
|---|---|---|
| Victims | Over 1 million | |
| Countries | More than 120 | |
| US credit cards stolen | 12.7 million to 115 million | |
| Defendants named in the suit | 25 unnamed individuals | The Register |
| Fraudulent websites created | Over 200,000 in 20 days | The Register |
| US laws invoked | 3 (RICO, Lanham Act, CFAA) | |
| Bills Google backed | 3 |
What to do now
These steps come from the US Federal Trade Commission and Google’s own guidance. They work in any country, even if the reporting number differs.
- Do not tap links in unexpected texts about parcels, tolls or unpaid fees. Open the official website or app yourself and check there.
- Turn on spam and scam protection in your messaging app. Most phones and messaging apps have a setting for this.
- Report scam texts to your mobile carrier and then delete them. In the US, you can forward them to 7726. Check with your local carrier for the equivalent service.
- If you already entered card details on a page like this, call your bank at once and ask for the card to be blocked. Speed matters here.
One habit I recommend: treat any text that pushes you to pay a small amount “today” as suspicious by default. Real delivery companies and toll operators rarely need you to act within minutes.
Why it matters
A lawsuit will not stop every scam text on its own, and the defendants are not named or in custody. Still, the case shows how industrial this business has become. We tend to imagine a lone scammer typing messages. What Google describes is closer to a software company, with a product, customers and hundreds of thousands of disposable websites.
Using RICO is also a signal. It frames smishing as organized crime rather than a nuisance, and it gives Google a legal route to go after the infrastructure behind the messages, not just individual senders.
For ordinary users, the practical lesson has not changed. The link in the text is the trap. If you go to the real website or app yourself, the fake page never gets its chance.
Sources
- Google blog, announcement of legal action and legislation against scammers, 12 November 2025, https://blog.google/outreach-initiatives/public-policy/legal-action-and-legislation-fight-scammers/
- The Register, report on Google suing 25 China-based scammers, 12 November 2025, https://www.theregister.com/2025/11/12/google_sues_25_chinabased_scammers/
- US Federal Trade Commission, consumer guidance on recognizing and reporting spam text messages, undated, https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages