Google sues China-based cybercrime ring accused of using AI to scam hundreds of thousands of victims

Google has filed a civil lawsuit in the US Northern District of California against what it describes as a China-based cybercrime operation, TechCrunch has reported. The complaint accuses the network of using AI tools to automate fraud at scale and alleges victim counts running into the hundreds of thousands. Google is also asking the court to authorise the dismantling of significant parts of the network's technical infrastructure.

The complaint says the network spent the past two years setting up fake e-commerce stores and crypto-currency platforms to lure victims. Google argues that the operation's technical backbone was systematic use of large language models, including Gemini. The models, the complaint says, were used to generate call-centre scripts, fake product descriptions, chatbot replies that imitated financial advisers, and victim-tailored messages in multiple languages including English.

Google says the network is part of an ecosystem known as "Lighthouse," linked to the "pig-butchering" scam operations run from China in recent years. In that model, workers — many of them coerced or trafficked into Southeast Asian compounds — spend their days contacting targeted victims. The addition of AI tools, Google says, is the main factor enabling the operation to scale.

A notable feature of the suit is that it targets not only named individuals but the technical infrastructure itself. Google describes at least 12 layers of infrastructure that run through services including Cloudflare, several domain registrars and a handful of payment processors. The approach mirrors recent suits in which Microsoft sought "infrastructure takedown" orders against state-linked threat actors such as Storm-0558.

The English High Court provides a comparable template: after Meta and WhatsApp won their spyware case against NSO Group, the company was ordered to take down portions of its server infrastructure. If decided in Google's favour, this lawsuit could become the first significant precedent for civil action against AI-enabled financial fraud.

Against the backdrop of inflation and energy costs, the business model of AI-powered scam call centres is already extremely profitable. A single "AI scammer" can interact with 10 to 20 times more victims simultaneously than a human team, and the quality of generated messages reads as close to, or above, human quality. Europol's 2025 annual report estimated that losses from AI-enabled scam operations rose from 12 billion euros in 2024 to 20 billion in 2025.

The victim profile is also changing. Traditionally, call-centre fraud has targeted older and less technically confident users; AI-generated content, fast translation and personalisation have started to pull in professional job-seekers, small-business owners and even finance-sector employees. The Banks Association of Turkey has reported a roughly 60 per cent rise in small-business fraud complaints in the past 12 months.

For AI companies, this case carries a political message too. Google, Anthropic and OpenAI all prohibit fraudulent use under their terms of service, yet monitoring and enforcement remain uneven. In one section of its complaint, Google says the network created cloned accounts to access Gemini in breach of those terms, reopening the question of how much in-house enforcement leverage AI providers actually have.

On the regulatory side, the US Federal Trade Commission (FTC) and the Department of Justice have been working in recent months on a joint framework for AI-enabled consumer fraud. The European Commission is debating similar provisions inside the secondary legislation that flows from its AI Act. If Google's case succeeds, it strengthens the position of technology platforms in court in both the US and EU; if it fails, it bolsters the argument that state actor intervention is needed.

The practical lessons for Vesper readers are familiar but more urgent than they used to be. The bar for scepticism toward "too good to be true" investment offers, get-rich-quick crypto platforms and chatbots posing as financial advisers needs to be higher than ever. In Turkey, suspected financial fraud can be reported to the Banks Association of Turkey at 0850 222 0 800 and to the Capital Markets Board (SPK) through its complaint portal. This article is not investment or legal advice.