Indian police are preparing to question Google after uncovering a massive network involving more than 500,000 fake Gmail accounts allegedly linked to hoax bomb threats against government offices.
The investigation, led by Gujarat Police, has uncovered 513,847 Gmail IDs and passwords that investigators say were being managed and used since 2022. Two people have been arrested in connection with the network, while authorities are now examining how such a large number of accounts were created and maintained without triggering Google’s security systems.
The case has raised fresh questions about online platform security, fake account creation and the ability of criminal networks to exploit legitimate email services for coordinated cybercrime.
Gujarat Police to Question Google Over Fake Gmail Accounts
Gujarat Police plans to formally approach Google as part of its investigation into the network.
Senior cybercrime official Vivek Bheda told Reuters that authorities would write to Google and seek policy changes to prevent security safeguards from being bypassed. Police are also considering formally making Google a subject of the investigation.
The police investigation is particularly focused on how criminals were able to create and manage hundreds of thousands of Gmail accounts.
Authorities are also examining how the accounts were authenticated because investigators reportedly found that the fraudulent accounts used two-factor authentication, a security feature designed to provide additional protection against unauthorized access.
Google had not immediately responded to requests for comment at the time of the Reuters report.
Bomb Threat Triggered the Investigation
The investigation began after the Gujarat government received a bomb threat email on September 10, 2026, just days before the recent BRICS summit in New Delhi.
According to police, the email threatened the Gujarat government and also mentioned the Prime Minister’s Office, the Union Home Minister’s office and countries cooperating with India during the BRICS summit.
Authorities determined that the threats were false, but the incident prompted a deeper cybercrime investigation that eventually exposed the much larger email network.
The discovery demonstrates how seemingly isolated bomb-threat emails can sometimes be connected to much broader digital criminal operations.
Police Discover 513,847 Gmail IDs and Passwords
During questioning and investigation, Gujarat Police reportedly recovered a list containing 513,847 Gmail accounts and corresponding passwords.
Police believe the accounts were part of an organized network that had been operating since 2022.
The scale of the operation has been described by investigators as unprecedented. Rather than relying on a small number of disposable email addresses, the network allegedly had access to hundreds of thousands of accounts that could be used for sending messages anonymously or at scale.
This has become one of the most significant questions in the investigation- How was such a huge collection of Gmail accounts created, authenticated and managed without being detected earlier?
Accounts Were Allegedly Sold to Buyers
Investigators are also examining possible international links to the operation.
According to police, one of the arrested individuals was in contact with a buyer in Bangladesh who allegedly purchased batches of the Gmail accounts.
Police said some payments were made using cryptocurrency, adding another layer of complexity to the investigation.
The alleged sale of accounts could indicate that the network was not created solely for one bomb-hoax campaign. Instead, investigators are examining whether the accounts formed part of a broader marketplace or service for people seeking large numbers of email identities.
Authorities will now have to determine who purchased the accounts, how they were used and whether they were connected to other cybercrime incidents.
Why Two-Factor Authentication Is a Major Concern
One of the most unusual elements of the case is the reported use of two-factor authentication on the fraudulent accounts.
Two-factor authentication, commonly known as 2FA, adds an additional verification step when users sign in. It is widely regarded as an important cybersecurity measure because a password alone is not sufficient to access a protected account.
The fact that investigators found 2FA associated with the accounts has raised questions about how the criminals were able to establish and control such a large number of accounts.
Police are investigating whether weaknesses in account-creation or verification processes were exploited.
Authorities have not publicly established that Google itself enabled or participated in the alleged criminal activity. The investigation is instead focused on understanding whether platform safeguards were insufficient or were bypassed by the suspects.
Google Faces Increasing Scrutiny in India
The investigation comes as Google faces wider scrutiny in India over the misuse of its technology platforms.
Indian authorities have previously investigated cases involving criminals allegedly exploiting Google’s services for fraudulent activity.
Reuters reported that Google is already under scrutiny over the misuse of Firebase, its web and app development platform, in financial scams.
The latest Gmail investigation could therefore increase pressure on technology companies to improve systems that detect large-scale abuse while ensuring legitimate users are not unnecessarily blocked.
India’s Growing Cybercrime Challenge
The case also highlights India’s broader struggle with cybercrime.
India has experienced a rapid increase in online fraud, identity theft, phishing and other forms of digital crime as internet and smartphone usage have expanded.
According to Reuters, India’s cybercrime problem causes losses of more than $2 billion annually from financial scams, while law enforcement agencies have increasingly focused on technology platforms that criminals allegedly exploit.
Fake email accounts can be particularly useful to cybercriminals because they can provide anonymity and allow attackers to send large numbers of messages without directly revealing their identities.
When such accounts are used for bomb threats, the consequences can go beyond financial losses.
Fake Bomb Threats Can Cause Major Disruption
Even when a bomb threat is ultimately found to be false, authorities must treat it seriously.
A threat against a government building can trigger security checks, evacuations, emergency responses and investigations.
Large-scale hoax campaigns can therefore place significant pressure on police and emergency services.
They can also create fear among the public and disrupt normal government operations.
The Gujarat case is particularly sensitive because the initial threat came shortly before an important international summit in New Delhi. Police said the message also threatened countries cooperating with India during the event.
International Connections Under Investigation
The reported Bangladesh connection has added an international dimension to the case.
Police are investigating whether the alleged buyer was simply purchasing Gmail accounts or whether the accounts were being distributed to additional individuals involved in cybercrime.
The use of cryptocurrency for at least some payments could make financial tracing more complicated.
Investigators are likely to examine digital devices, transaction records, account activity and communications to determine the wider network behind the operation.
However, many details remain under investigation, and allegations against suspects have not yet been established in court.
What Could Google Be Asked to Change?
Gujarat Police has indicated that it wants Google to strengthen its safeguards so that account-creation protections cannot be bypassed on such a large scale.
Potential areas of concern include detecting unusually large account-creation activity, identifying suspicious authentication patterns and improving systems that flag coordinated abuse.
At the same time, technology companies face a difficult balancing act.
Gmail is used by billions of legitimate users, and overly aggressive restrictions could make it harder for individuals and businesses to create or manage accounts.
The challenge is therefore to identify criminal activity without creating unnecessary barriers for ordinary users.
The Bigger Cybersecurity Lesson
The Gujarat investigation illustrates an important change in modern cybercrime.
Criminal networks do not always need to develop sophisticated hacking tools. Sometimes they can misuse legitimate platforms and services at enormous scale.
Email accounts, cloud infrastructure, messaging applications and web-development platforms can all potentially be abused when criminals discover ways around security controls.
For technology companies, this means cybersecurity is no longer limited to preventing unauthorized access.
It also involves identifying large-scale coordinated abuse of legitimate services.
Investigation Could Have Wider Implications
The Gujarat case could have implications beyond the specific bomb threats currently being investigated.
If police establish that the accounts were systematically created, sold and distributed for criminal purposes, authorities could investigate whether similar networks have been responsible for other threats or cybercrime incidents.
The discovery of more than half a million accounts gives investigators a potentially large dataset to examine.
Police may be able to determine when accounts were created, how they were accessed and whether groups of accounts were used together in previous incidents.
Conclusion- India Investigates Massive Gmail Network Behind Hoax Threats
The discovery of 513,847 Gmail IDs and passwords has turned a single bomb-hoax investigation in Gujarat into a much broader cybersecurity case.
Indian police now want answers about how such a large network of fake accounts was created, authenticated and allegedly distributed to buyers.
The decision to question Google also reflects growing pressure on major technology companies to prevent their platforms from being exploited for large-scale criminal activity.
For Google, the case could lead to renewed scrutiny of Gmail’s account-creation and authentication safeguards. For Indian law enforcement, the priority will be identifying the people behind the network and determining whether the accounts were used in other cybercrime operations.
As investigations continue, the case serves as another reminder that online security threats can quickly move from individual fake accounts to highly organized, large-scale networks.
Kode Digital Blog is a technology-driven platform sharing insights on software development, AI, digital marketing, and business growth.
© 2026 Kode Digital. All rights reserved.
