When everyday scam texts stopped looking like the work of one person

You know the texts. The unpaid toll you definitely never racked up. The delivery that's mysteriously stuck somewhere. The rewards points that are about to vanish unless you click right now. They've been clogging American phones for years, and most of us learned to thumb past them without a second thought.

But something's shifted. These messages aren't always the handiwork of a lone scammer hunched over a laptop anymore. Google says artificial intelligence is now letting fraudsters run operations that are bigger, faster, and far more convincing than anything they could pull off before. And it's not just talk — the company has gone to court over it, filing a lawsuit against a cybercrime network that leaned on its own Gemini AI to build phishing websites and fuel a scam campaign aimed at millions of people.

That's the uncomfortable part. The same kind of tool you might use to draft an email or plan a trip got turned into a factory for fraud.

Inside the Outsider Enterprise, the network Google is going after

The lawsuit points at a Chinese cybercrime group that goes by the name Outsider Enterprise. This wasn't some loose collection of opportunists. The group organized itself through Telegram and handed out ready-made phishing kits to criminals scattered around the world — basically a starter pack for ripping people off, distributed at scale.

Here's where Gemini comes in. The network used the AI to spin up fake websites impersonating brands people instinctively trust: Google itself, YouTube, even the US Postal Service. The goal was simple and old as the internet — make something look legitimate enough that you let your guard down and hand over your details. What's new is the speed. Building convincing imposter sites used to take real effort. With AI doing the heavy lifting, the group could churn out hundreds of them at a pace that simply wasn't possible before.

The numbers behind the Gemini-powered phishing campaign are staggering

This is where it stops feeling abstract. The scale is genuinely hard to picture.

  • The group built more than 9,000 fake websites and over one million fraudulent URLs.
  • In a single two-week stretch ending June 1, Android users flagged 55,000 suspicious texts.
  • Over that same window, the Outsider Enterprise pushed out 2.5 million messages carrying links to its fake sites.

Think about that for a second. One million fraudulent web addresses isn't a campaign you stumble into by accident. It's an assembly line. And every one of those links was a tiny trap waiting for someone tired, distracted, or just unlucky enough to tap it.

What the FBI says it actually cost real people

The damage isn't theoretical, and the figures are grim. The FBI estimates this operation lifted 3.87 million credit card numbers from victims spread across dozens of countries. Total losses? Roughly $1.9 billion since July 2023.

That's not a rounding error or a worst-case projection. That's billions of real dollars pulled out of real accounts, one fake "verify your details" page at a time. When people say AI is lowering the barrier to entry for scammers, this is the concrete version of what they mean.

How Google is fighting back against AI-powered scams

Google isn't just naming the problem — it's trying to dismantle it. The company has asked a New York federal court to shut the operation down entirely, and it's not going it alone. Google is working alongside the FBI and the big carriers — AT&T, T-Mobile, and Verizon — to stop these texts before they ever light up your screen.

There's also a lot already happening quietly in the background. Google's built-in messaging defenses intercept over 10 billion malicious messages every month, and Android's scam detection tool flags sketchy calls and contacts in real time. So while the headlines are about the lawsuit, the day-to-day protection is running constantly, whether you notice it or not.

Why Google is pushing Congress to get involved

Lawsuits are slow, and Google seems to know that legal action by itself won't be enough here. The company is also backing seven bipartisan bills in Congress, hoping to make these protections permanent rather than reactive. The reasoning is blunt: AI has made this kind of threat effectively limitless, so you can't just sue your way out of it one network at a time. You need rules that hold up after the next Outsider Enterprise shows up — and there will be a next one.