Google faces questions over fake Gmail accounts

Indian police are set to question Google over inadequate safeguards following the dismantling of a criminal network that operated over 500,000 fake Gmail accounts to disseminate false bomb threats to government offices, a police official disclosed to Reuters on Tuesday. Google, a subsidiary of Alphabet Inc, is currently facing scrutiny in India due to its role in facilitating financial scams through its Firebase web development platform.

In Gujarat, India's western state, authorities recently dismantled an email network responsible for sending inter-state bomb threats, arresting two individuals and uncovering 513,847 Gmail IDs and passwords in use since 2022. Vivek Bheda, a senior cybercrime official from Gujarat police, told Reuters that this is the first time Google has been implicated in the investigation.

The scale of the fake Gmail accounts in use is unprecedented, and the police plan to formally designate Google as a subject of the investigation soon, Bheda added.

The Gujarat investigation was initiated after a bomb threat email was received by the state government on September 10, coinciding with the BRICS summit in New Delhi. The threat also targeted countries cooperating with India during the summit. Although the threats were later found to be false, one of the arrested individuals had connections with a buyer in Bangladesh who purchased the fraudulent accounts and paid a portion in cryptocurrency to send the fake emails.

The use of two-factor authentication, an additional security measure offered by Google, has raised concerns among police about how the criminal network managed to operate such a large number of accounts.