We do not hand grocery shoppers a microscope and ask them to test the beef for E. coli before they buy it. We built inspection, cold-chain rules, recall systems, and liability because contamination became an industrial problem, and “be careful at the checkout” stopped being a serious answer to an industrial problem.
I keep coming back to that gap, because it is the exact gap I see in how we still talk about scams. The threat industrialized years ago. The defense is still personal, still manual, still aimed at a shopper holding a phone in one hand.
This is a Lab piece, so let me do what the Lab is for: take a week’s headline apart and look at what it actually re-priced.
1. The barrier did not lower. It collapsed.
Last week the FBI and Google dismantled a phishing-as-a-service operation called Outsider Enterprise. Most of the coverage filed it under “win,” and it was one. But read the complaint and it stops looking like a crime story and starts looking like a product teardown.
Outsider sold phishing the way a SaaS company sells software. Based in China, run through Telegram, it charged $88 a week or $200 a month through a self-serve bot. Subscribers picked from more than 290 pre-built templates impersonating banks, wireless carriers, government agencies, state DMVs, the postal service, and toll systems. The FBI ties the platform to roughly 3.87 million stolen credit cards and an estimated $1.9 billion in losses since 2023. In one two-week window in May, the network pushed 2.5 million scam texts at Android users alone.
No coding required. You paid, you picked a template, you pressed go.
Here is the detail that should retire the “look for the typos” era for good. Google’s filing alleges Outsider gave customers a tutorial showing them how to make Gemini write the phishing page itself, by dressing the request up as an innocuous “gift redemption page” with inline CSS and no JavaScript so it read like ordinary coding help. The hardest part of the operation, the part that used to require an actual skilled human, got automated and packaged. That is the whole event in one fact. The barrier to entry did not lower. It collapsed.
And this is not a one-off arrest. Google sued a different phishing platform, Lighthouse, last November, tied to more than a million victims across 120 countries. Interpol’s analysis puts AI-enhanced fraud at roughly 4.5 times more profitable than the conventional kind. Outsider is not the anomaly. It is the category maturing.
2. The defense is built for a threat that no longer exists
For twenty years we have treated scams as a personal literacy problem. Check the sender. Hover over the link. Watch for urgency. That advice was written for a world where the scam was a clumsy message and an attentive person was the firewall. That world is gone.
I build landing pages for a living. I run paid media, and I run this Lab on impersonation and AI-era trust. So I will say it plainly: the pages these kits produce are not the sloppy fakes the old advice was written for. They are clean. The grammar is fine. The logo is right. The page is mobile-optimized and it loads in the same place your real alerts load. The visual tell that the advice depends on is gone.
It gets worse for the individual-vigilance model. Outsider’s kit could request SMS codes, PINs, email codes, and app approvals in real time, which means it could pull a one-time passcode out of a victim mid-session and walk straight through two-factor authentication. So the fallback advice, “turn on MFA,” is being routed around too. When the criminal infrastructure has productized the defeat of the defense you just recommended, the defense was never the system. It was a speed bump the supply chain already mapped.
This is the part worth sitting with. The scam is now a manufactured product: templated, priced, distributed, supported, and optimized for conversion. It has a pricing page. It has tiers. It has a churn problem and a roadmap. You do not defeat a supply chain by handing the shopper a magnifying glass.
3. We have run this play before
We solved this exact shape of problem with food a century ago. One restaurant mishandles a chicken, you inspect the restaurant. Thousands of contaminated products show up across the country, you do not solve it at the dinner table. You go upstream. You inspect the plant, trace distribution, force the recall, and put liability where the system keeps letting harm through.
Personal responsibility still exists in that model. Nobody gets to leave raw chicken on the counter all day. But we never made personal responsibility the entire system, because we understood that no shopper can inspect every farm, truck, and warehouse between the field and the plate. We built the layers first, and we treated the shopper’s judgment as the last line, not the only one.
Scam defense is still stuck at the dinner table. We keep shipping end-user advice for a supply-chain problem, then calling the person gullible when the supply chain wins.
4. Upstream is not a wish. It is what just happened.
The encouraging part of the Outsider takedown is that it shows the upstream layer is real and can move. Google did not publish a tip sheet. It filed a civil suit under RICO to seize the infrastructure, and it is coordinating with AT&T, T-Mobile, and Verizon to block the messages before they land. Lumen’s Black Lotus Labs mapped the network. The FBI seized the servers, the wallets, and the group’s own Telegram bot. There is a legislative track behind it, the Stop SCAMS Act, because the people closest to this understand that takedowns alone do not scale.
That is the model in miniature: detection, disruption, blocking, and liability, applied at the choke points rather than at the phone. The question for the next five years is not whether upstream defense works. The Outsider case proves it can. The question is whether we make it routine and measured instead of episodic and heroic.
5. What each layer should actually be measured on
Upstream accountability is empty until you can score it. Here is how I would measure each layer, because what does not get measured stays optional.
Carriers. Percentage of mass-scale impersonation messaging blocked before delivery, and median time from first detection of a campaign to network-wide block. If a campaign can run for days, the filter is decorative.
Banks and payment processors. Whether their own alert flows train customers to tap links under stress, and how fast a confirmed mule or fraud-receiving account is frozen after the first report. A bank that texts link-bearing “verify now” alerts is manufacturing the exact behavior the scammers exploit.
Brands being impersonated. Time to detect and report a lookalike domain, and the share of impersonation domains taken down within twenty-four hours. This is the metric I would put in the Lab as impersonation exposure, and almost no brand tracks it. They instrument their SEO obsessively and their impersonation surface not at all.
Registrars and hosting providers. Repeat-abuse concentration. When the same provider keeps appearing in takedowns, that is not bad luck, it is a business model, and it should carry escalating cost.
AI providers. Detection rate on staged or disguised malicious generation, specifically the “build me an innocuous gift redemption page” pattern that Outsider productized. The failure mode is no longer the obvious harmful prompt. It is the benign-looking request assembled into something harmful one safe step at a time.
App stores and platforms. Whether a marketplace or coordination hub gets to shrug when its tools are repeatedly used to industrialize harm, or whether repeat facilitation carries consequences.
None of this removes individual judgment. It just stops pretending individual judgment is the architecture.
6. The one rule worth keeping at the individual level
Do not trust the message. Trust the channel you open yourself.
Account locked? Open the app. Package delayed? Type the carrier’s address or use your saved app. Bank alert? Call the number on the back of the card. The habit is not link inspection, because link inspection is the losing game now. The habit is abandonment and independent verification: leave the message, confirm from somewhere you control.
That is the seatbelt. It is not the vehicle-safety regime, and we should stop selling it as one.
Rob’s predictions
1. Phishing-as-a-service goes agentic within eighteen months. Today’s kits sell templates. The next generation sells campaign operation: an agent that spins up the page, rotates domains, fires the messages, and harvests credentials with no operator babysitting it. The marketing copy will say “set and forget.” Outsider already automated the page build. Automating the campaign is the obvious next SKU.
2. SMS one-time passcodes start getting deprecated faster than planned. Once the real-time-OTP-capture capability in kits like Outsider is common knowledge, SMS-based 2FA loses its remaining credibility, and passkeys plus phishing-resistant, app-bound approval accelerate. The institutions still leaning on SMS codes in 2027 will look the way unencrypted password storage looks now.
3. Liability moves upstream, and a precedent case sets it. Within a couple of years, a carrier, bank, or hosting provider faces a precedent-setting regulatory action or suit for failing a reasonable duty to stop mass impersonation. This is the food-and-auto pattern repeating. The first ruling that treats “we just delivered the messages” as insufficient will reprice the whole category’s risk.
4. Impersonation exposure becomes a budgeted line item. Brands start instrumenting their own impersonation surface, monitoring the domains, the SMS sender IDs, and the AI-generated lookalikes targeting their customers, the way they instrument search visibility today. This is the Exposure Economy logic applied to defense: in a world where trust is cheap to forge at scale, verifiable provenance of a real message becomes an asset worth defending and measuring.
5. “Benign-looking generation” becomes a named, scored AI safety category. The disguised-request jailbreak that Outsider taught its customers will stop being treated as an edge case and become a measured failure mode that providers compete and get regulated on. Detecting harm assembled across innocuous-looking steps becomes a distinct discipline from blocking the obviously harmful prompt.
Closing
When a scam works, we ask why the victim clicked. That question has always pointed at the most embarrassed, least powerful person in the chain. The better question is why the message reached them at all. Two and a half million texts did not slip through a crack. They moved through carriers, networks, registrars, and hosts that had the standing to stop them and the data to see them coming. “Why did they click” interrogates the shopper. “Why did this reach them” interrogates the supply chain. Only one of those questions scales.
Outsider Enterprise was not a clever message. It was a factory with pricing tiers, customer support, and a self-serve checkout, producing contaminated trust at industrial volume. We know how this story ends, because we have run it before with food, with cars, with medicine, with every product that got dangerous at scale. The answer was never to turn every shopper into an inspector. The answer was to stop the contaminated product before it reached the shelf.
The factory is built. The only question left is whether we keep writing better warning labels, or start treating the shelf like it is our job too.
Sources: FBI (Operation Ghost Hook, part of Operation Riptide), the Google civil complaint and General Counsel blog post, Lumen’s Black Lotus Labs, Interpol’s AI-fraud analysis, and reporting from SecurityWeek, BleepingComputer, Tom’s Hardware, and CyberScoop, June 2026.