Gujarat police have uncovered 513,847 fake Gmail accounts and passwords allegedly used to send hoax bomb threats to government offices, prompting plans to question Google over how the accounts were created and operated at scale.
The investigation began after a bomb threat email was sent to the Gujarat government on September 10, days before a recent New Delhi summit of the BRICS grouping. The message also threatened countries cooperating with India during the summit, according to a police statement. The threats were found to be false.
Police in Gujarat broke up the email network this week and arrested two people, a senior cybercrime official said. The network was allegedly sending what police described as “inter-state” bomb threats. The accounts had reportedly been in use since 2022.
Vivek Bheda, a senior cybercrime official with the Gujarat police, told Reuters that the scale of the fake accounts was unprecedented. Police plan to write to Google seeking policy changes to prevent safeguards from being bypassed, he said. Authorities also plan to formally designate Google as a subject of the investigation.
Google, which is owned by Alphabet, did not immediately respond to a request for comment. It was not immediately clear what legal charges or penalties, if any, the company could face.
Investigators allege that one of the arrested individuals was in contact with a buyer in Bangladesh who purchased batches of the accounts. The buyer allegedly paid partly in cryptocurrency and used the accounts to send fake emails. Police are examining the cross-border nature of the activity as part of the investigation.
The use of two-factor authentication on each fraudulent account has emerged as a particular concern for investigators. Two-factor authentication is an additional security measure offered by Google to protect user accounts. Police are investigating how the criminal network was able to create and maintain such a large number of accounts while using that security layer.
The case adds to growing scrutiny of technology platforms in India as law enforcement agencies investigate how online services are exploited for organised crime. Authorities have previously examined the misuse of Google’s Firebase web development platform in financial scams, according to the report.
India is one of Google’s largest markets by users. The country’s cybercrime problem includes financial scams that cause losses of more than $2 billion a year, according to the report, increasing pressure on law enforcement agencies to pursue both criminal networks and the digital systems they use.
The immediate investigation will focus on the arrested individuals, the alleged Bangladesh connection, the creation and management of the accounts, and the safeguards that allowed the network to operate. Gujarat police are expected to formally contact Google as the probe proceeds.
