Google RICO Lawsuit Targets China Smishing Ring Behind Toll Text Scams

For years, the telltale scam text has been almost comedically mundane: an unpaid toll here, a stuck package there, a small fee demanded with suspicious urgency. In November 2025, Google made clear it no longer finds the genre funny, filing a first-of-its-kind federal lawsuit against a China-based criminal network it says industrialized the text-message scam into a subscription business13. The suit, filed in the Southern District of New York, targets 25 unidentified operators — listed in the complaint as John Does 1 through 25 — who allegedly run a phishing-as-a-service platform called Lighthouse15.

How the scam machine worked

The mechanics, as described across the coverage, are chillingly simple. Lighthouse subscribers paid a recurring fee through a Telegram bot and gained access to a kit the complaint itself calls phishing "for dummies"4. For their money, customers got access to more than 600 spoofed website templates impersonating over 400 legitimate entities — the U.S. Postal Service, E-ZPass, Apple, banks, tolling agencies, and Google itself45. Google's own logo appeared on roughly a quarter of the templates, which is why the company brought trademark claims alongside the criminal ones5.

The lures worked because they exploited trust in everyday institutions. A recipient would get a text about an unpaid toll or an undeliverable package, tap the link, land on a convincing replica of a familiar brand's payment page, and start typing in card details. According to Axios's reading of the complaint, victims didn't even need to hit "submit" for their data to be stolen, because the kit logged keystrokes in real time4.

The identity-theft pipeline

The most consequential detail, reported consistently by KrebsOnSecurity and Axios, is what happened after the card number was harvested. Lighthouse was built to defeat multi-factor authentication: when a victim's bank sent a legitimate one-time verification code to the victim's phone, the scammer's system would prompt the victim to enter that code on the fake screen, letting the fraudster link the stolen card to a mobile wallet on a device the criminals controlled45. Researchers say the groups would load multiple stolen wallets onto each phone, wait 7 to 10 days, and then either use the devices for fraud or sell them5.

That turns a "small" toll payment into full-blown identity and account compromise — card data, banking credentials, and in some templates the ability to hijack PayPal accounts outright5. The scale Google alleges is enormous: between 12.7 million and 115 million U.S. credit cards potentially compromised, and more than a million victims across 120 countries46. In one 20-day window alone, Google estimates Lighthouse generated 200,000 fraudulent websites4. Axios notes the FBI separately tallied more than $16 billion stolen from U.S. consumers in the most recent year of data4.

Why a RICO suit?

Google's legal theory is the story's most interesting wrinkle. Rather than relying only on trademark and computer-fraud statutes, the company invoked the Racketeer Influenced and Corrupt Organizations Act — the 1970s law designed to dismantle the Mafia — arguing that Lighthouse is a full criminal enterprise with division of labor135. The complaint describes five specialized teams: developers who built the software, data brokers who compiled victim lists from breaches and public records, spammers who blasted out messages using banks of phones and SIM cards, a theft group that drained accounts and laundered proceeds, and administrators who ran Telegram tutorials and posted screenshots of brokerage accounts with seven-figure balances as recruitment ads345.

The network's coordination channel reportedly had around 2,500 members36. One security firm's analysis found the group bragging of "300+ front desk staff worldwide" supporting its fraud and cash-out operations5.

The marketplace angle

The lawsuit also pulls back the curtain on a newer variant of the scam that goes beyond the toll text. According to researchers cited by KrebsOnSecurity, Lighthouse customers increasingly used the kit to mass-produce fake e-commerce storefronts — shops selling everything from phone cases to groceries — advertised through Google Ads and Meta platforms, paid for with stolen credit cards45. A shopper searching for a product would find what looked like a good deal, place an order, and get phished for a one-time code at checkout. The product never arrives, and the payment details go straight into the criminal pipeline.

Experts quoted in the coverage noted that this fake-marketplace approach has more staying power than traditional phishing sites precisely because it takes longer for victims and platforms to flag it as fraudulent5. Google says it has suspended the associated ad accounts, but the scammers had used fake identities to slip past verification4.

What happens now

Google's general counsel, Halimah DeLaine Prado, has been candid that the suit is less about recovering victims' money than about deterrence — raising the cost of running these enterprises and, as security researcher Wouter Gosschalk told CBS, ensuring the individuals behind them can never safely travel to the United States1. Google also won a temporary restraining order within hours of filing, and reported in an update that the Lighthouse operation is now "essentially dark"1.

Whether "essentially dark" means "permanently dark" is the open question. Ford Merrill, a security researcher quoted by KrebsOnSecurity, was blunt: the Chinese mobile phishing economy is so lucrative that the Lighthouse operators will likely burn their Telegram channels, rebrand, and rebuild rather than vanish5. Much of the group's phishing infrastructure, per the Silent Push research cited there, sits with two Chinese hosting companies, Tencent and Alibaba — raising the possibility that a default judgment could eventually pressure those providers to shut down the domains5.

Google is simultaneously pursuing the policy route, endorsing anti-scam legislation in Congress including the GUARD Act, the Foreign Robocall Elimination Act, and the SCAM Act34.

What consumers should actually do

The practical takeaway hasn't changed, but it's worth restating: never tap links in unexpected texts about tolls, packages, or account problems — go directly to the official app or website instead. iPhone users can enable "Filter Unknown Senders" and "Filter Junk"; Android users can turn on Spam Protection and forward suspicious texts to 7726 (SPAM)1. Both platforms' filtering features occasionally catch legitimate messages, so it's worth checking those folders periodically1.

The deeper lesson from the Lighthouse case is that the person on the other end of that scam text isn't a lone hustler — it's a division of an organized enterprise with developers, data brokers, cash-out crews, and customer support, all operating at industrial scale. The scammers have built the machinery. Google is betting that American racketeering law, of all things, is the tool that can take it apart.