Google Faces Police Questioning Over 500,000 Fake Gmail Accounts Used for Bomb Threats

Google Under Police Scrutiny Over Fake Gmail Accounts

Google is facing police questioning in India after investigators uncovered a large criminal network allegedly involving more than 500,000 fake Gmail accounts.

The accounts were reportedly created and managed to send hoax bomb threats to government offices and other institutions. Gujarat Police have arrested two individuals and recovered a database containing 513,847 Gmail IDs and passwords.

Police are now examining whether weaknesses in Google's account-creation and authentication safeguards allowed the network to operate on such a large scale.

Gujarat Police Uncover Massive Email Network

The investigation began after a bomb-threat email was sent to the Gujarat government on September 10, shortly before the recent BRICS summit in New Delhi.

The threat reportedly targeted the Gujarat Secretariat and other high-profile institutions and also referred to countries cooperating with India during the summit. Authorities investigated the email and traced its digital trail to an inter-state network.

The investigation led to arrests in Bihar and Jharkhand and the discovery of the extensive database of email accounts.

513,847 Gmail IDs and Passwords Recovered

One of the most significant findings was a list containing 513,847 unique Gmail IDs along with their passwords.

Police suspect that the accounts had been created for sending threatening emails to government offices, schools, colleges and courts, as well as for other cybercrime activities.

The scale of the operation has raised concerns among investigators. Gujarat cybercrime officials described the number of fake accounts as unprecedented.

Why Is Google Being Questioned?

The police investigation is not necessarily an allegation that Google itself participated in the criminal activity.

Instead, investigators want to understand how criminals were able to create such a large number of accounts and bypass safeguards designed to prevent abuse.

A senior Gujarat cybercrime official said police plan to write to Google and seek policy changes so that the safeguards used to create accounts cannot be bypassed. Google is also expected to become a formal subject of the investigation.

Two-Factor Authentication Raises Questions

Investigators were particularly concerned that the fraudulent accounts reportedly used two-factor authentication, an additional security layer intended to make accounts harder to compromise.

Police are examining how criminals were able to create and manage such a huge number of accounts while apparently using authentication mechanisms associated with legitimate Gmail users.

Understanding this process could help investigators determine whether there were gaps in Google's account-registration and verification systems.

Bomb Threats Were Reportedly Hoaxes

Authorities said the bomb threats uncovered during the investigation were false.

The September 10 email targeting the Gujarat government triggered a security response, but investigators subsequently determined that the threats were hoaxes.

The incident nevertheless created significant concern because government buildings and other institutions must treat bomb threats seriously, regardless of whether they ultimately prove genuine.

Possible Bangladesh Connection Under Investigation

Investigators have also identified a possible cross-border element to the network.

According to police, one of the arrested individuals was in contact with a buyer in Bangladesh who allegedly purchased batches of the fake accounts. Some payments were reportedly made using cryptocurrency.

Police are continuing to investigate the identities of other people involved and the intended use of the large database of Gmail credentials.

Criminal Network Allegedly Active Since 2022

The recovered information suggests that the network may have been operating since 2022.

The accounts were allegedly maintained for potential use in sending threatening messages and conducting other cybercrime activities.

Investigators are now examining whether the same network was connected to other bomb threats or criminal communications sent from fake email addresses.

Google Has Yet to Comment

Google, which is owned by Alphabet, had not immediately responded to Reuters' request for comment at the time of reporting.

It is also not yet clear what legal consequences, if any, Google could face as a result of the investigation.

The immediate focus of the police inquiry is expected to be on understanding how the safeguards were bypassed and whether changes are required to prevent similar misuse.

India's Growing Cybercrime Challenge

The case comes amid increasing concerns about cybercrime and the misuse of online platforms in India.

Technology platforms are increasingly being examined by law enforcement agencies when criminals use legitimate digital services for fraud, threats, account abuse and other illegal activities.

Reuters reported that cybercrime causes losses of more than $2 billion a year in India through financial scams, highlighting the scale of the country's broader digital-security challenge.

Why the Case Matters for Gmail Security

The discovery of more than half a million fake Gmail accounts raises broader questions about online identity verification and platform security.

Email services must balance two competing objectives: making account creation accessible to legitimate users while preventing automated or fraudulent account creation.

If criminals can create large numbers of accounts and maintain them for long periods, those accounts can potentially be used for spam, fraud, threats and other forms of cybercrime.

What Could Happen Next?

The investigation is expected to focus on several key questions:

• How were more than 500,000 Gmail accounts created?

• How were Google's authentication safeguards bypassed?

• Who else was involved in managing the accounts?

• Were the accounts sold or distributed to other criminal groups?

• Were the same accounts used for other threats or cybercrimes?

• What security changes could prevent similar abuse?

Police are expected to seek information from Google as the investigation progresses.

Bottom Line

The discovery of 513,847 fake Gmail accounts has triggered serious questions about how criminals were able to exploit a major email platform on such a large scale.

Gujarat Police have arrested two people and are investigating an alleged network that used fake accounts to send hoax bomb threats to government offices and other institutions.

Google is expected to be questioned about the safeguards surrounding account creation and authentication, particularly how such a large number of fraudulent accounts could reportedly be established despite security measures such as two-factor authentication.

The case highlights the growing challenge for technology companies and law enforcement agencies to prevent legitimate online platforms from being misused for large-scale cybercrime.