India orders removal of Google Firebase accounts after spotting scam pattern

Indian government has ordered Google to remove hundreds of Firebase web development accounts following a pattern of cybercriminals using the platform to impersonate major banks and defraud people, according to government notifications and a source familiar with the investigation. In August alone, the Indian Cyber Crime Coordination Centre (I4C) directed the removal of at least 57 websites and databases hosted on Firebase, alleging they were used to distribute malware and steal sensitive financial information from victims' phones.

The notices to Google, reviewed by Reuters, did not blame the company directly but stated that if the named links were not taken down within three hours, Google could be held liable. Scammers are increasingly using Firebase for phishing, malware, and financial fraud, exploiting its widespread user base and generous free options.

Indian officials noticed scammers migrating to Firebase from other free tools, drawn by advanced database features. The fraud involves tricking victims into downloading apps mimicking legitimate banking services, which then exfiltrate user data to the scammer's Firebase database, effectively leading to a phone hack and further financial fraud.