Google vs Outsider Enterprise: AI and SMS fraud on a global scale

Case timeline: from the operation to the lawsuit

On June 12, 2026, Google filed a lawsuit against the criminal group Outsider Enterprise, which operates out of China. According to TechCrunch, the group sent 2.5 million fraudulent SMS messages in just two weeks. The operation also reached hundreds of thousands of victims worldwide.

The most significant element isn't the scale of the attack, impressive as it is. It's the systematic use of artificial intelligence to automate, personalize and make scam messages believable. We are looking at a qualitative leap in organized cybercrime.

Google chose the legal route as a deterrent. The move is also symbolic: it signals that big tech platforms don't intend to stop at passive defense. Instead, they are taking a proactive, judicial approach against malicious actors.

How AI turned phishing into an industrial machine

Traditional phishing campaigns were limited by how much content humans could produce. Today, generative AI has removed that bottleneck. As a result, a criminal group can generate millions of personalized messages in a few hours, adapting tone, language and context to each recipient's profile.

In the Outsider Enterprise case, the SMS messages were designed to look like legitimate communications. The linguistic and contextual sophistication was high enough to fool even reasonably careful users. On top of that, AI made it possible to constantly vary templates to evade spam filters.

According to McKinsey analyses, AI-driven cybercrime is growing faster than organizations' ability to defend against it. SMEs are especially exposed because they often lack dedicated cybersecurity teams. The gap between attack and defense widens every quarter.

Winners and losers: who comes out of this worst off

Google's legal action is a partial win for the digital ecosystem. Still, the damage Outsider Enterprise has already done is hard to reverse. Hundreds of thousands of victims suffered financial losses, data theft and compromised credentials.

Among the hardest hit are small and medium-sized businesses that use SMS for commercial or transactional messages. The confusion caused by fraudulent messages erodes customer trust, even in legitimate communications. As a result, the reputational damage reaches far beyond the direct victims of the scam.

By contrast, big platforms like Google come out with a stronger public image. The legal initiative shows a real commitment to fighting cybercrime. Still, it remains an open question how much these actions can truly slow criminal operators working in jurisdictions that are hard to reach.

SHM Studio's take: the risk for Italian B2B and retail SMEs

At SHM Studio, we're following this case closely because of what it means for Italian businesses. B2B and retail SMEs are exposed on two fronts. First, as potential direct victims of SMS fraud campaigns. Second, as companies whose brand can be impersonated in smishing operations.

The second scenario is often underestimated, so it's worth a closer look. A company may find its name or domain used in fraudulent messages without knowing it. Customers who receive SMS messages that appear to be signed by the company lose trust in the brand. The damage lands on a business that has done nothing wrong.

That's why managing your digital reputation and monitoring your brand online are essential parts of a mature digital marketing strategy. It's no longer just about visibility, but about the integrity of the signal you send to the market.

What nobody is saying: defensive AI is still behind

The public debate focuses on AI as an offensive tool for cybercrime. But one aspect is rarely discussed with the candor it deserves: AI-based defense systems are structurally behind attack tools.

According to Gartner, most organizations still invest mainly in traditional perimeter security. Attackers, meanwhile, have already moved the battlefield to AI-enhanced social engineering. There is a structural mismatch between the nature of the attacks and the defensive resources deployed.

Likewise, the spam and anti-phishing filters of messaging platforms struggle to keep up with how fast AI-generated templates mutate. So the most effective defense isn't strictly technological. It's cultural and procedural: staff training, verification protocols, and structured, recognizable digital communications.

Operational implications for anyone managing business digital communications

The Outsider Enterprise case points to a few concrete priorities for Italian companies. First, make sure your digital communication channels, including email, SMS and push notifications, are authenticated and monitored. Without authentication, it's easier for third parties to impersonate your brand.

It's also worth reviewing your copywriting strategy for commercial communications. Messages with a recognizable structure, a consistent tone and verifiable calls to action make convincing forgeries harder. Customers used to a precise communication style also spot anomalies more easily.

When it comes to Google Ads campaigns and LinkedIn activity, it's a good idea to strengthen brand consistency across channels. That way, any departure from your usual communication pattern looks suspicious to your audience right away. It's a competitive advantage built over time with a consistent SEO and digital marketing strategy.

Finally, if your company uses artificial intelligence tools in its processes, it's essential to document and tell customers how and when AI is used. This creates a level of transparency that also works as a barrier against impersonation fraud.

Next moves: what we expect over the next 12-18 months

Google's legal action is an important precedent. But it's unlikely to solve the structural problem of AI-driven cybercrime on its own. It's reasonable to expect escalation on several fronts over the next 12-18 months.

On the regulatory front, the European Union is speeding up the adoption of specific rules on the use of AI in potentially harmful contexts. In particular, the European AI Act introduces transparency obligations that could complicate, at least in part, the operations of AI systems used for large-scale fraud. However, its effectiveness will depend on the ability to enforce it across borders.

On the technology side, we expect investment to accelerate in advanced authentication systems for SMS and messaging channels. Business messaging platforms are also considering stricter checks for commercial senders. As a result, companies that have already built a solid digital identity will start with an edge.

For Italian SMEs, our practical advice is simple: don't wait for regulation to force changes. As Harvard Business Review has also reported, organizations that get ahead of regulatory and technological shifts in security gain measurable competitive advantages. To learn how to build a secure, recognizable digital presence, explore our web services and the resources on the SHM Studio blog, or contact the team for a personalized assessment.