FBI helps take down AI phishing ring

That suspicious text about a package, toll bill or account problem may look harmless at first. You glance at it, see a familiar brand name and think, "I'll just check." That quick tap can lead straight into a professional scam funnel.

Sign up for my FREE CyberGuy Report

Outsider Enterprise was a phishing-as-a-service operation. In other words, it gave other criminals the tools to run scams. Instead of one scammer typing out sloppy messages from a laptop, this setup worked more like a criminal software business. It offered phishing kits, fake websites and infrastructure that helped criminals impersonate trusted brands.

Google says the network was tied to more than 9,000 fake websites and over 1 million fraudulent URLs. Those sites were designed to look real enough to trick people into entering credit card details, passwords or other sensitive information.

The scams often started with text messages. Some appeared to come from major wireless carriers, delivery services, toll agencies or other familiar companies. That's what makes these attacks so dangerous. The text may arrive in the same place you get real alerts from banks, delivery services or phone providers.

FBI Cyber Division Assistant Director Brett Leatherman said Outsider infrastructure was tied to an estimated 3.87 million stolen credit cards and $1.9 billion in losses.

The action against Outsider Enterprise included both technical and legal steps. The FBI said the technical takedown was dubbed Operation Ghost Hook. Leatherman also tied the effort to Operation Riptide, a broader FBI campaign aimed at disrupting cybercrime operations.

The FBI and its partners seized administration servers, phishing domains, a Shopify storefront and about $100,000 from payment wallets tied to the operation.

Text scams often arrive when you are distracted. Maybe you are heading into a meeting, paying bills or waiting for a package. A message about an account problem can make you react fast before you stop to question it.

These steps can help you avoid the fake texts, fake websites and account traps that phishing operations rely on.

Treat unexpected links like a warning sign, even when the message looks official. Go directly to the company's app or website instead. Type the address yourself or use a saved bookmark.

Scammers want you to panic. Take a breath before you act. Real companies usually give you more than a few minutes to fix an issue.

Look closely at the domain name before typing in a password, card number or code. A scam site may use one extra word, a strange ending or a spelling that looks close to the real company.

A legitimate company will not ask you to send back a one-time code by text. If someone asks for a code, assume they are trying to break into your account.

If a text asks for a credit card number, password or account login, stop. Open the official app or call the company using a number from your card, bill or trusted website.

Spam protection can help move suspicious texts out of your main inbox before you accidentally tap a bad link.

On iPhone: Go to Settings > Apps > Messages > Unknown Senders > turn on Screen Unknown Senders. You can also open Messages, tap Filters and review messages under Unknown Senders or spam/junk filtering when available.

For suspicious texts on iPhone, use Report Junk when it appears under the message.

On Samsung using Google Messages: Open Google Messages > tap your profile icon or initials > tap Messages settings > tap Spam protection or Protection & Safety > turn on Enable spam protection.

For suspicious texts on Samsung, open the message in Google Messages, tap the three dots, tap Details and choose Block & report spam.

Set a strong account password and add a carrier PIN when your provider offers one. This helps protect your phone number from criminals who try to hijack accounts or reset passwords.

Scammers often sound convincing because they already know something about you. That information can come from people-search sites, data brokers, old breaches or public records. Consider using a data removal service to reduce how much personal information is floating around online. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Some banks and card issuers offer virtual card numbers. These can limit the damage if a shopping site, fake checkout page or scam link steals payment details.

Does this takedown make you feel better about the fight against scammers, or do you still think the crooks are one step ahead? Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.