India Orders Google to Kill Hundreds of Firebase Accounts Used in Bank Scam Network

India's Cyber Crime Coordination Centre, known as I4C, sent Google at least three notices in August demanding the takedown of 57 websites and databases hosted on Firebase, Google's app and website development platform. That's according to government notices reviewed by Reuters.

The agency says it found a pattern: criminals building fake banking apps and phishing pages on Firebase to steal financial data from Android users. Seven of the 57 flagged sites impersonated login pages for State Bank of India, ICICI Bank and Axis Bank, according to Reuters and confirmed by Outlook Business and Cryptopolitan.

The rest were described as data-collection points, vacuuming up stolen credit card numbers and one-time passwords straight off victims' phones.

How the scam worked

An I4C notice dated August 17 laid out the playbook. Android malware disguised itself as legitimate banking apps and targeted credit card holders specifically, dangling bait like new credit card offers, reward redemptions, and credit limit upgrades, according to the notice cited by Reuters.

A victim installs what looks like their bank's app. The malware then quietly ships the victim's data to a Firebase database controlled by the scammer, according to Cryptopolitan and Outlook Business. From there, scammers potentially get a foothold into other apps on the phone and a path to the victim's money.

One scheme identified by officials didn't even bother with banks. It exploited PM-KISAN, the federal program that sends direct payments to small farmers. Fake sites promised to help farmers claim payments and told them to download an app, which then handed their data to the attackers, according to Outlook Business.

Google's liability window and its response

Under the notices, Google can be held liable for named links if it doesn't remove them within three hours of notification, according to Reuters and multiple outlets reviewing the same notices. That's a tight legal clock for a company operating a platform used by millions of developers globally.

Google said it has "strict policies prohibiting the use of our services for phishing, malware, or financial fraud" and works with law enforcement, including I4C, to evaluate and act on notices, the company told Reuters.

None of the government notices reviewed by Reuters suggested Google or Firebase bore responsibility for the scams themselves. This is a platform-abuse problem, not an allegation that Google built or condoned the fraud infrastructure.

Why Firebase, why now

A source with direct knowledge of the matter told Reuters that scam operators have been migrating to Firebase from other free tools since last year, drawn by its generous free tier and database features. The number of Firebase-related notices sent to Google has run into the dozens in recent months, the source said, without giving an exact figure.

Firebase is part of Google Cloud, which pulled in roughly $25 billion in revenue last quarter, according to TradingView's reporting on Alphabet's financials. A platform that big, with that much free-tier accessibility, is a target-rich environment for criminals looking for cheap, reliable infrastructure that doesn't raise red flags with victims.

The scale of the problem

This isn't a one-off. Indians lost nearly $2.4 billion in alleged cyber fraud in 2025, according to government data cited by Reuters. India's real-time payments system processed roughly 242 billion transactions between January 2026 and March 2026, according to Cryptopolitan and Outlook Business, citing the same government figures. That's an enormous attack surface for fraudsters running phishing operations at scale.

The government's usual response has been reactive: find the scam website, order it killed. The Firebase notices suggest a shift toward going after the infrastructure layer instead of just individual scam pages, a point Cryptopolitan's reporting emphasized more directly than the other outlets.

What's unresolved

India's home ministry, which oversees I4C, did not respond to Reuters' questions about the scale or scope of the crackdown. It's also unclear how many of the "hundreds" of flagged accounts have actually been shut down versus how many notices are still pending inside Google's three-hour compliance window.

Google has not said whether it plans to change Firebase's verification or onboarding process to make it harder for scammers to spin up fraudulent apps and databases in the first place. Given that operators are reportedly still migrating onto the platform because of its free tier, whether this month's 57 takedowns represent a meaningful disruption remains to be seen.