Gujarat Police Uncover 500,000 Fake Gmail Accounts Linked To Hoax Bomb Threats

Gujarat Police have uncovered an alleged cybercrime network involving more than 500,000 fake Gmail accounts that were reportedly used to send hoax bomb threats, raising questions over how such a large network was able to operate despite Google’s security safeguards. Investigators found a database containing 513,847 Gmail usernames and passwords, with the accounts allegedly in use since 2022.

Two people have been arrested in connection with the investigation, according to senior cybercrime official Vivek Bheda. He said investigators plan to approach Google and seek stronger security measures to address loopholes that may have enabled the network to create and manage large numbers of fraudulent accounts. Authorities also intend to formally name Google as a subject of the investigation, according to Bheda.

The case came to light after Gujarat authorities received an email on September 10 warning of a bomb attack, days before leaders gathered in New Delhi for the BRICS summit. The threat reportedly extended to countries cooperating with the Indian government during the high-profile meeting. Investigators subsequently determined that the warning was a hoax and began tracing the accounts and infrastructure allegedly connected to the message.

Also Read: 5 From Bihar Held Over Fake Fertiliser Franchise And Loan Scam

Police believe the network supplied batches of Gmail accounts to customers, including at least one buyer in Bangladesh. According to investigators, the buyer allegedly used the accounts to send fake bomb threats and paid for them at least partly using cryptocurrency. The findings have expanded the investigation beyond the individual threats to the wider system through which the fraudulent accounts were allegedly generated and distributed.

A major concern for investigators is that the accounts reportedly had two-factor authentication enabled. This has raised questions about how such a large number of accounts could be created and maintained despite Google's additional security checks. The police investigation will examine how the accounts were generated, whether existing safeguards were circumvented and whether changes to Google's policies may be necessary.

The investigation comes as Indian authorities are also examining the alleged misuse of Google’s Firebase web development platform in financial scams. Google, which is owned by Alphabet, had not immediately responded to a Reuters request for comment. Gujarat Police’s findings are expected to put further focus on the effectiveness of account-creation safeguards and the challenges of preventing large-scale misuse of online services.

Also Read: World Circular Economy Forum Heads To Gujarat In South Asia First