Indian authorities have uncovered a scam pattern in which criminals used Google’s Firebase service to impersonate banks and steal customers’ data.
Indian authorities have ordered Google to shut down dozens of websites and databases hosted on its Firebase platform after finding that they were being used in scam schemes, Reuters reported, citing a source familiar with the matter.
The Indian Cyber Crime Coordination Centre (I4C) directed Google in August alone to take down at least 57 websites and databases hosted on Firebase. According to the authorities, the sites were being used to distribute malware and steal sensitive financial information from victims’ phones. Google can be held liable for the named links if they are not taken down within three hours of receiving a notice.
Indian officials have noticed a growing “pattern” of scammers using Firebase. The I4C has sent Google dozens of requests to remove such resources in recent months, a source told Reuters.
Seven of the resources targeted for removal were phishing pages created using Firebase that mimicked major Indian banks, including State Bank of India, ICICI Bank and Axis Bank. The remaining websites were used to collect data stolen from victims’ phones, including credit card details and one-time passwords.
The scams typically involved tricking victims into installing apps that looked like legitimate banking services. The apps then sent users’ data to the scammers’ Firebase database, effectively allowing them to hack the phone, access other installed apps and defraud customers of their funds.
One scheme exploited the PM-KISAN federal government programme, which pays small farmers roughly 2,000 Indian rupees (about $21) every four months. Websites allegedly promised recipients help in claiming their payments and asked them to download an app to redeem the money. The app then sent the victims’ data to the scammers.
Indian authorities have also warned about similar malware programs, widely known among cybersecurity researchers as “Android God Mode,” a term describing near-total control over victims’ phones. Such malicious apps often impersonate trusted banking, government and utility services and trick users into installing them through links.
Google said it has “strict policies prohibiting the use of our services for phishing, malware, or financial fraud.” The company added that it works with law enforcement agencies, including I4C, to evaluate and act on notices.
Firebase is used by millions of developers worldwide to build apps and host websites. It is part of Google’s cloud business, which generated nearly $25 billion in revenue in the most recent quarter. According to the Indian government, scammers have been migrating to Firebase from other free tools since last year, drawn by its generous free options and more capable database features.
The issue has become particularly important for India as its digital payments ecosystem continues to expand. Nearly 242 billion digital transactions were processed through the country’s real-time payments system alone in the year to March 2026, making India one of the world’s largest digital payments markets.
Source: Reuters
