Google Sues AI-Powered Scam Ring That Sent 2.5 Million Texts in Two Weeks
A group called 'Outsider Enterprise' allegedly used AI to blast scam messages at scale. Google's lawsuit is the right move, but it won't be the last time we have this conversation.
Crédit photo: Image via TechCrunch — AI. Used under fair use for news commentary. · source
2.5 million text messages. Two weeks. That's not a scam operation, that's an industrial process.
Google filed suit this week against an alleged Chinese cybercrime outfit that, according to the company, used AI to flood hundreds of thousands of victims with fraudulent text messages. The group goes by the name "Outsider Enterprise," which, honestly, sounds like a startup pitch deck more than a criminal enterprise, but here we are. According to TechCrunch, Google says the group sent those 2.5 million texts over a span of just fourteen days. That's the number that should stop you cold.
Because here's the thing. Before AI tooling got cheap and accessible, running a scam operation at that volume required serious infrastructure, real coordination, probably dozens of people. Now, apparently, you need a group name and a model fine-tuned for deception. The barrier to entry just collapsed, and we're only starting to see what that means.
I've been covering tech since the nineties. I watched spam email go from novelty to existential nuisance to something we mostly just... live with now. I watched robocalls do the same thing. Every time a new communication channel opens up, someone figures out how to weaponize it at scale, and then we spend a decade playing catch-up. AI-assisted fraud is just the latest iteration of that cycle, except the scaling curve is steeper and the personalization is better.
À lire aussi
More in Policy
The SpaceX IPO is the biggest market event in years, and everyone's acting like nothing like this has ever happened. It has.
Mark Kowalski · 6 hours ago · 7 min
Tech Secretary Liz Kendall pledged stronger backing for Britain's AI sector at London Tech Week, but the specifics remain thin and the robotics research community has heard this kind of thing before.
Aisha Patel · 22 hours ago · 8 min
A $75 billion debut, a fixed price set before the roadshow, and pension managers already raising red flags. SpaceX's IPO is historic in more ways than one.
Sarah Williams · Yesterday · 5 min
Brian Schimpf's comments at Founders Forum signal a meaningful shift in how defense-tech startups are thinking about manufacturing geography, and what that means for allied industrial capacity.
The robocall era at least had some friction. You needed phone numbers, you needed dialers, you needed some basic social engineering script that a human had written once and you just repeated. AI changes that last part. The messages can be varied, contextually aware, harder to filter. The same underlying model that helps a small business write a product description can, in the wrong hands, generate thousands of slightly different phishing texts that slip past keyword-based detection. That's not hypothetical anymore. That's what Google is alleging happened here.
Call me old-fashioned, but I think we underestimated how fast this would arrive.
Let's be clear about what a civil lawsuit can and can't accomplish when the defendants are allegedly operating out of China. Google can win in a U.S. court and still never collect a dime or see anyone face real consequences. The legal system doesn't have great reach across that particular border, and everyone involved knows it.
So why sue? A few reasons, and they're not nothing.
First, it creates a legal record. Google's complaint will document the technical methods, the scale, the specific infrastructure allegedly used. That becomes a reference point for regulators, for other companies building defenses, for future litigation. It's a paper trail that didn't exist before.
Second, it sends a signal to the broader ecosystem. Other AI platform providers, cloud hosts, SMS gateway services, they're all now on notice that facilitating this kind of operation carries legal risk. Whether that changes behavior is unclear, but the threat is real.
Third, and maybe most importantly for Google specifically, it's a PR move. Google's platforms were apparently used as part of this operation. Filing suit lets them say, loudly and publicly, that they fought back. Whether the underlying systems failed in ways that need addressing, well, the lawsuit doesn't really answer that question.
Here's what bothers me more than this specific case. 2.5 million texts in two weeks is a lot, but it's also probably not the ceiling. It might not even be close to the ceiling.
The economics of AI-assisted fraud are genuinely alarming. The marginal cost of sending the ten-millionth scam text is basically zero once you've built the pipeline. The same is true for AI-generated phishing emails, deepfake voice calls, synthetic social media profiles used for manipulation. Every one of these attack vectors is getting cheaper and more sophisticated simultaneously, and the defensive infrastructure, the filters, the detection models, the regulatory frameworks, those move slower. They always have.
I only found two sources on this specific lawsuit so far, both from TechCrunch, so the technical details of exactly how the AI was deployed remain somewhat thin. We don't know yet whether "Outsider Enterprise" built their own models, used commercial APIs with jailbroken prompts, or accessed something through less legitimate channels. That distinction matters for how you think about prevention. If they used a major commercial API, that's a platform governance problem. If they built their own, that's a different challenge entirely.
Google suing a Chinese cybercrime group is a bit like filing a strongly worded letter with the ocean. It might make you feel better. It won't stop the tide.
What would actually help is a combination of things that are, frankly, politically and technically hard. Real-time SMS authentication at the carrier level. Stricter know-your-customer requirements for AI API access at scale. International agreements on cybercrime that have actual teeth, which is sort of a fantasy given the current geopolitical situation but still worth saying out loud. And probably some liability framework that gives platform providers a real incentive to invest in abuse detection rather than just reacting after the fact.
None of that happens fast. In the meantime, hundreds of thousands of people got scam texts, some of them probably lost money, and a group called "Outsider Enterprise" is presumably still out there doing whatever comes next.
Google's lawsuit is the right move. It's just not sufficient. And the gap between "right move" and "sufficient" is where a lot of people are going to get hurt before this gets better.
If you want to argue about that, my email's on the about page.
