Google sues China-based scam operators flooding Americans' phones

• Scammers made off with more than $16 billion from consumers in the last year, according to the most recent FBI data.

Driving the news: Google filed a civil suit in the Southern District of New York seeking to dismantle the group behind Lighthouse.

• Google says it's the first lawsuit of its kind aimed specifically at a phishing-as-a-service operation.
• For a monthly fee, Lighthouse's software kit lets cybercriminals easily launch text-message scams and set up fake websites that mimic legitimate brands.

Between the lines: The complaint describes Lighthouse as part of a "relentless phishing campaign" that has impacted more than a million people and potentially compromised between 12.7 million and 115 million credit cards in the U.S. alone during just one text scam operation.

• In one 20-day period, Google estimates that Lighthouse was used to create 200,000 fraudulent websites and attacked more than 1 million potential victims in at least 121 countries, per the filing.

How it works: Lighthouse is marketed as a plug-and-play platform for phishing scams — a "phishing for dummies" kit, as the lawsuit puts it.

• Users subscribe via Telegram, where a self-service bot lets them pay for access to the software on a "weekly, monthly, seasonal, annual, or permanent" basis, per the complaint.
• From there, they choose from over 600 spoof templates mimicking more than 400 entities, including the U.S. Postal Service, New York City's government, Apple, banks and toll agencies.
• Lighthouse allows users to sort phishing templates by geographic region, so a scammer can easily select fake websites that will resonate with local targets.

Threat level: Lighthouse also has several mechanisms designed to evade detection.

• Victims receive a text prompting them to pay a toll or redeliver a package.
• When they visit the fake website, they're asked to enter payment info. They don't even need to click "submit" for the data to be stolen because the software is tracking their keystrokes in real time.
• If multi-factor authentication is enabled, Lighthouse triggers the victim's bank to send a legitimate verification code to their phone and then tricks the victim into entering it on a fake screen, allowing scammers to evade any suspicions and add the card to their digital wallet.

Zoom in: Google's complaint paints Lighthouse as a full-fledged criminal enterprise with separate teams dedicated to development, data brokering, spam delivery, financial theft, and marketing.

• Data brokers gather personal info from breaches, social media and public records.
• Spammers use phones, modems and SIM cards to send mass messages in bulk.
• A so-called "theft group" uses the stolen info to drain bank accounts, launder money and resell credit card information on the dark web.
• And admins run tutorials, answer questions, and post screenshots of brokerage accounts with balances in the millions to entice new scammers to "start fishing."

The intrigue: Some Lighthouse users have purchased online ads, including through Google Ads, to funnel victims to fake retail sites selling everything from phone cases to groceries.

• Google says it has since suspended those accounts, but scammers used fake identities to bypass verification.

What to watch: Google is also endorsing three anti-scam bills today that have already been introduced in Congress: the GUARD Act, the Foreign Robocall Elimination Act, and the SCAM Act.

Go deeper: Government imposter scams surge amid shutdown