Indian police will question Google over safeguards after uncovering more than 500,000 fake Gmail accounts allegedly used to send hoax bomb threats to government offices, with authorities preparing to make the technology company a formal subject of their investigation.

Gujarat police arrested two people this week after dismantling an email network that had created and managed 513,847 Gmail IDs and passwords since 2022. Senior cybercrime official Vivek Bheda told Reuters that the scale of the operation was unprecedented.

“We will write to Google, ask them to make some policy changes so (safeguards) cannot be bypassed,” Bheda said, adding that police planned to formally designate Google as a subject of the investigation.

The investigation began after Gujarat's state government received a bomb threat by email on 10 September, days before the recent BRICS summit in New Delhi. Police said the message threatened countries cooperating with India during the summit, but Bheda said the threats were false.

Police said one of the arrested individuals had been communicating with a buyer in Bangladesh who purchased batches of the fraudulent accounts. The buyer reportedly paid partly in cryptocurrency and used the accounts to distribute the fake bomb threats.

A key concern for investigators is that each of the fraudulent Gmail accounts had two-factor authentication enabled, according to Bheda. The additional security measure is offered by Google to protect accounts, leaving investigators examining how the network was able to create and operate such a large number of accounts despite the safeguards.

Google, which is owned by Alphabet, had not responded to a request for comment at the time of publication. Reuters said it was not immediately clear whether the company could face legal charges or penalties as a result of the investigation.

The case comes as Google faces wider scrutiny in India over criminal activity involving its technology. Authorities have identified a pattern of criminals misusing Firebase, Google's web development platform, in financial scams.

India's law enforcement agencies have increasingly investigated technology platforms that are allegedly exploited in cybercrime, as financial scams cause losses of more than $2 billion a year in the country. The Gujarat case adds scrutiny of account-creation and authentication controls to existing concerns around the misuse of online services.

The investigation will now examine how the criminal network obtained and managed hundreds of thousands of accounts, as well as how its safeguards were bypassed.

---