India orders removal of Google Firebase accounts after spotting scam pattern

India has ordered Google to remove hundreds of Firebase web development platform accounts after identifying a pattern of criminals using the service to impersonate major banks and commit fraud, according to government notices and a source familiar with the matter. Cybercrime in India is a significant issue, with individuals losing nearly $2.4 billion in alleged cyber fraud in 2025, as reported by government data.

In recent years, Indian authorities have targeted scammers by ordering website removals; however, officials have recently noticed a pattern of scammers utilizing Google's Firebase tool, which hosts millions of users worldwide. The Indian Cyber Crime Coordination Centre (I4C) directed the removal of at least 57 websites and databases hosted on Firebase in August, claiming they were used for distributing malware and stealing sensitive financial information from victims' phones, as stated in three notices sent to Google and reviewed by Reuters.

While there was no indication in the notices that Google or Firebase were at fault, Google could be held liable if the named links are not taken down within three hours of the notice. Android-based malware programs are mimicking legitimate banking services, specifically targeting Android users with credit cards, according to I4C.

Scammers lure victims with offers such as new credit cards, reward redemptions, or credit limit upgrades. The total number of notices sent to Google regarding Firebase exceeds dozens in recent months. In August, seven of the 57 targeted websites and databases were phishing pages created using Firebase, mimicking top Indian banks, including State Bank of India, ICICI Bank, and Axis Bank.

The remaining websites were designed to collect stolen data from victims' phones, including credit card details and one-time passwords. The government has previously issued an advisory in March without naming Firebase but raised concerns about such malware, referred to as "Android God Mode" by cybersecurity researchers, describing the near-total control over victims' phones.