India orders removal of Google Firebase accounts after spotting scam pattern

India has directed Google to shut down hundreds of accounts on its Firebase web development platform after finding a pattern of criminals misusing the service to impersonate major banks and defraud people, according to government notices and a source familiar with the matter.

Online scams have become one of India’s most pressing law enforcement challenges, with Indians losing nearly $2.4 billion in alleged cyber fraud in 2025, according to government data. For years, the government has gone after scammers by ordering their websites removed.

Of late, however, Indian officials have noticed a “pattern” that ‌scammers are using the ⁠Google’s app ⁠and website development tool Firebase, which has millions of users the world over, according to the source with direct knowledge of the matter.

The Indian Cyber Crime Coordination Centre (I4C) has directed at least 57 websites and databases that were hosted on Firebase be taken down in August alone, saying they were being used to distribute malware and steal sensitive financial information from victims’ phones, according to three notices sent to Google and reviewed by Reuters.

There was no suggestion in the notices that Google or Firebase were in any way responsible. However, Google can be held liable for the named links if they are not taken down within three hours of the notice being issued.

“Android-based malware programs are masquerading as legitimate banking services, specifically targeting Android users with credit cards. Scammers lure victims by promoting offers such as new credit cards, reward redemptions, or credit limit ⁠upgrades,” I4C ‌said in an August 17 notice to Google, directing the removals.

The source added the total number of notices sent to Google over Firebase ran into dozens in recent months, without sharing an exact number.

Alphabet-owned Google said in a statement the company has “strict policies prohibiting the use of our ⁠services for phishing, malware, or financial fraud” and works with law enforcement, including I4C, to evaluate and act on notices.

Representatives for India’s home (interior) ministry, which controls the I4C, did not respond to questions.

BOOMING DIGITAL USE

Firebase is used by millions of developers worldwide to build apps and host websites. It is part of Google’s cloud business, which generated nearly $25 billion in revenue in the most recent quarter.

Scam operators have been migrating to Firebase from other free tools since last year, drawn by generous free options and more capable database features, the Indian government has assessed, the source said.

Scammers are increasingly targeting India’s booming digital payments ecosystem. Nearly 242 billion digital transactions were processed through India’s real-time payments system alone in the year to March 2026, making it one of the world’s largest digital payments markets.

Reuters reviewed three government notices sent by I4C to Google in August, accessed through Lumen, a non-profit database where companies ‌like Google voluntarily submit content removal requests they receive.

“ANDROID GOD MODE”

Seven of the 57 websites and databases asked to be removed were phishing pages created using Firebase that mimicked top Indian banks, including State Bank of India, ICICI Bank and Axis Bank. The remaining were what the government agency said were websites created to collect data stolen from victims’ ⁠phones, including credit card details and one-time passwords.

The three banks did not respond to queries from Reuters.

The fraud described in the notices worked by getting victims to install apps that looked like legitimate banking services.

One scheme exploited by scammers was PM-KISAN, a federal government programme that pays small farmers roughly 2,000 Indian rupees (about $21) every four months, according to a fourth notice and the source with direct knowledge.

Websites allegedly promised recipients help in claiming their payment, asking them to download an app to redeem the money.

Then, the app sends the user’s data to the scammer’s Firebase database, effectively leading to a hack of the phone where scammers can access other downloaded apps and defraud customers of their funds.

The government issued one public advisory in March, without naming Firebase, but raising concerns about such malware, widely called “Android God Mode” by cybersecurity researchers, a term describing the near-total control over victims’ phones.

“These malicious apps often impersonate trusted services such as banking, government and utility platforms, and trick users into installing them through links,” the advisory said.