Indian police to query Google over 500,000 fake Gmail IDs linked to bomb hoax

New Delhi, Sept 15 - Indian police are set to question Google regarding inadequate security measures after dismantling a criminal network that created and managed over 500,000 fake Gmail accounts to send fake bomb threats to government offices, a police official disclosed to Reuters on Tuesday. India ranks among Google's largest markets by users, where the U.S. tech giant is already facing scrutiny due to authorities discovering a pattern of criminals exploiting its web development platform, Firebase, for financial scams.

In Gujarat, western India, police recently dismantled an email network that sent inter-state bomb threats, arresting two individuals and uncovering 513,847 fake Gmail IDs and passwords in use since 2022. This marks the first time Reuters has reported that Google is the subject of the ongoing investigation. Vivek Bheda, a senior cybercrime official with Gujarat police, told Reuters that the scale of fake Gmail accounts in use is unprecedented.

Police plan to formally designate Google as a subject of the investigation in the near future. Google, owned by Alphabet Inc, has not responded to a request for comment. The legal consequences or penalties, if any, that Google might face are yet to be determined. India's increasing cybercrime results in losses exceeding $2 billion annually from financial scams, and law enforcement has been intensifying efforts to target technology platforms believed to have been exploited to facilitate such crimes.

The Gujarat investigation commenced following a bomb threat email received by the state government on September 10, just days before the BRICS summit in New Delhi. The threats, which also sought to intimidate nations cooperating with India during the summit, turned out to be false, according to Bheda. One of the arrested suspects had connections to a buyer in Bangladesh who purchased account batches and paid partially in cryptocurrency to dispatch the fake emails.

Police are particularly concerned that each fraudulent account utilized two-factor authentication, a supplementary security feature offered by Google to enhance account safety. The exact methods employed by the criminal network to achieve this on such a massive scale is another facet of the ongoing investigation.