India orders removal of Google Firebase accounts after spotting scam pattern

The Indian government has instructed Google to remove hundreds of accounts from its Firebase web development platform following the discovery of a scam pattern, according to reports and sources familiar with the situation. Online scams pose a significant challenge for Indian law enforcement, with citizens losing around $2.4 billion to alleged cyber fraud in 2025, as per official data.

In the past, authorities have targeted scammers by ordering the removal of their websites. However, Indian officials have recently observed a pattern where scammers exploit Google's Firebase tool, which has millions of users globally, for malicious activities.

The Indian Cyber Crime Coordination Centre (I4C) has issued at least 57 notices in August, directing the removal of websites and databases hosted on Firebase. These sites were allegedly used to distribute malware and steal sensitive financial information from victims' phones, according to three notices to Google reviewed by Reuters.

Google can be held accountable for the named links if they are not taken down within three hours of receiving the notice. Android-based malware imitating legitimate banking services is being used to target Android users with credit cards, with scammers luring victims through offers for new credit cards, rewards, or credit limit upgrades.

The Indian government believes scammers are increasingly migrating to Firebase from other free tools due to its generous free options and advanced database features.

Of the 57 targeted accounts, seven were phishing pages mimicking major Indian banks like State Bank of India, ICICI Bank, and Axis Bank. The remaining sites were designed to collect data stolen from victims' phones, including credit card details and one-time passwords. The targeted banks did not respond to inquiries from Reuters.

The fraud schemes involved getting victims to install apps that appeared to be legitimate banking services. One scheme, allegedly promoting the PM-KISAN government program, asked users to download an app to claim their payment, which then sent user data to the scammers' Firebase database, effectively hacking the victim's phone and enabling further fraud.

The government had previously issued a public advisory in March, raising concerns about such malware, known as "Android God Mode" by cybersecurity experts.