Google sues Chinese criminal network that used AI to defraud hundreds of thousands

Google has filed a civil lawsuit against a group identified as Outsider Enterprise, a China-based cybercrime operation that, according to the company, used artificial intelligence tools to defraud hundreds of thousands of people. In a period of just two weeks, the group sent 2.5 million fraudulent text messages. The figure alone illustrates the scale that automation and AI tools can enable when in the hands of malicious actors.

The lawsuit, filed on June 12, 2026 and reported by TechCrunch, marks one of the first instances in which a major technology company has directly pursued a civil legal route against a fraud network that explicitly used AI as an operational lever.

What exactly did Outsider Enterprise do

According to Google's allegations, the group operated infrastructure designed to scale fraud through AI: automated message generation, personalization of lures, and presumably management of false identities to evade spam filters. The 2.5 million SMS messages in fourteen days equates to approximately 178,000 daily communications, a volume that is not achievable without advanced automation.

The pattern corresponds to what the industry calls smishing, phishing via SMS, a tactic that has grown steadily over the past two years precisely because language models allow the generation of persuasive and grammatically correct text at nearly zero cost. There is no longer a need for a team of copywriters; just a well-tuned prompt and access to an API.

Why Google is acting with a civil lawsuit

The international criminal route against operations based in China is, in practice, a dead end: judicial cooperation is limited and timelines are incompatible with the speed of this type of fraud. The civil lawsuit, by contrast, allows Google to seek injunctive relief, block accounts, domains and associated infrastructure, and establish a legal precedent that could deter other actors.

This is not the first time Google has used this strategy. The company has previously turned to civil lawsuits to dismantle advertising fraud networks and malware operations. In this case, the novel angle is the explicit use of AI as the central argument in the accusation, which could set legal precedent regarding liability in deploying these tools for criminal purposes.

Who this matters for

For security and compliance teams at companies that manage messaging channels or user communication, this case sends a clear signal: AI-assisted smishing is not a future threat, it is the present. Organizations that rely on SMS for authentication, notifications, or customer support must review their verification protocols and fraud reporting workflows.

For developers integrating language models into products, the case reinforces the importance of acceptable use controls and abuse detection systems. The same capability that allows a model to draft a useful support email can, without safeguards, produce thousands of personalized scam messages.

Finally, for the ongoing regulatory debate, both in the European Union with the AI Act and in other national frameworks, this case provides a concrete and documented example of malicious use at industrial scale, something that has been lacking in many discussions that tended toward the abstract.

The limits of lawsuits as a tool

It is worth being precise about what a civil lawsuit can and cannot achieve. Dismantling technical infrastructure within Google's jurisdiction, domains, accounts, and Google Cloud services, is viable. Reaching individuals operating from China is considerably more difficult. The track record of similar cases suggests that these actions work better as a mechanism for operational disruption than as a path to effective prosecution.

That said, the value of the precedent is not insignificant. Each lawsuit of this kind contributes to building a legal framework in which the use of AI for mass fraud has documented consequences and real costs for those who facilitate it, even if indirectly.

---

Editorial note: Google's decision to make the use of AI explicit as the central element of the accusation is deliberate and likely strategic. We will see whether courts adopt this framing or dilute it into more generic legal categories; the usefulness of this approach for future cases will depend largely on that response.