India orders Google to remove Firebase accounts used in scams: report

India has ordered Google to remove hundreds of accounts from its Firebase development platform after investigators found scammers using the service to impersonate banks, distribute malware and collect information stolen from Android phones.

The Indian Cyber Crime Coordination Centre, or I4C, sought the removal of at least 57 Firebase-hosted websites and databases through three notices issued in August, Reuters reported on Friday, 21 August.

Seven of the links were phishing pages that mimicked State Bank of India, ICICI Bank and Axis Bank. The others were allegedly being used to receive credit-card details, one-time passwords and other information extracted from compromised phones.

The notices did not accuse Google or Firebase of participating in the fraud. Google said it had “strict policies prohibiting the use of our services for phishing, malware, or financial fraud” and worked with I4C and other law-enforcement agencies to assess takedown requests.

The reported campaign nevertheless shows how criminals are moving beyond disposable websites and using the same cloud infrastructure that legitimate developers rely on.

Firebase provides tools for hosting websites, authenticating users, sending notifications and storing application data, allowing a fraudulent operation to connect its phishing page, malicious app and stolen-data repository within one development environment.

Scammers have been moving to Firebase from other free services since last year, attracted by its free options and database capabilities, according to the government’s assessment cited by Reuters.

The attacks begin with an offer that appears to come from a bank, such as a new credit card, reward redemption or credit-limit increase. Victims are directed to install an Android application outside an official app store. The application then seeks accessibility permissions that can allow it to read screens, intercept messages and operate other applications.

A separate scheme used websites purporting to help farmers claim payments under PM-KISAN, which provides eligible beneficiaries ₹2,000 about every four months. Victims were asked to download an application that allegedly sent information from their phones to a Firebase database.

I4C warned about this class of malware in March, describing it as “Android God Mode” because of the extensive device access it can obtain. Its public advisory urged users to download applications only from official stores, avoid files received through links or messaging services and refuse accessibility permissions requested by suspicious apps.

The takedown orders also test the tighter compliance timetable imposed on technology platforms in India. Amendments that took effect in February require an intermediary to disable unlawful material within three hours after receiving a qualifying court order or reasoned government notice, replacing the earlier 36-hour limit. Failure to comply can put its legal safe-harbor protection at risk, according to the amended IT rules.

The scale of India’s payment system makes this an operating issue for more than cloud companies. Government data show that citizens reported 2.4 million financial cyber-fraud complaints involving ₹22,495 crore, or about $2.35 billion, in 2025. The figures describe amounts reported, rather than independently verified final losses, according to a home ministry response.