India has stepped up its crackdown on online financial fraud after government authorities identified a recurring pattern of scammers misusing Google’s Firebase platform to impersonate banks, distribute malware and steal sensitive financial information.
The Indian Cyber Crime Coordination Centre (I4C) has directed Google to take down at least 57 websites and databases hosted on Firebase in August alone, according to government notices reviewed by Reuters. The notices cited the use of these services for phishing, malware distribution and the theft of sensitive information from victims’ devices.
The action highlights a growing challenge for India’s digital ecosystem, where the same cloud and development platforms that enable legitimate businesses and developers can also be exploited by cybercriminals. With digital payments expanding rapidly across the country, scammers are increasingly looking for ways to exploit users’ trust in familiar banks, government schemes and financial services.
Firebase Misused to Target Banking Customers
According to the I4C notices, several Firebase-hosted websites were designed to impersonate major Indian banks, including State Bank of India, ICICI Bank and Axis Bank. The fraudulent pages were reportedly used to trick users into downloading malicious Android applications or sharing sensitive information.
The government said some of the malicious apps were disguised as legitimate banking services and targeted Android users with credit cards. Victims were reportedly lured with offers such as new credit cards, reward redemptions and credit-limit upgrades.
Of the 57 websites and databases flagged by I4C in August, seven were identified as phishing pages mimicking major Indian banks. Others were allegedly being used to collect information stolen from victims’ phones, including credit card details and one-time passwords.
The notices also warned that Google could face liability for the named links if they were not removed within three hours of receiving the government’s orders.
Importantly, the notices did not allege that Google or Firebase was responsible for the fraudulent activity. Google said it maintains strict policies against phishing, malware and financial fraud and works with law enforcement agencies, including I4C, to assess and act on such notices.
Scammers Shifting to Firebase
The latest action points to a broader change in how cybercriminals are operating online. According to market sources, Indian officials have observed scammers increasingly moving to Firebase from other free online tools. The platform’s free offerings and database capabilities have reportedly made it attractive to fraud operators looking for inexpensive infrastructure to host scam websites and store stolen information.
Firebase is widely used by developers to build applications and websites and is part of Google’s cloud business. The challenge for platforms such as Firebase is therefore to distinguish legitimate development activity from infrastructure being deliberately used to support fraud.
The growing misuse also illustrates how cybercriminals are adapting their infrastructure as authorities and technology companies become more effective at taking down traditional scam websites.
Banking and Government Schemes Among Key Targets
The scams identified by Indian authorities have not been limited to banking services.
One scheme highlighted in the government notices allegedly exploited the PM-KISAN programme, which provides financial assistance to eligible farmers. Fraudulent websites reportedly promised users help in claiming their payments and directed them to download an application.
Once installed, the malicious application could send information from the victim’s device to a database controlled by the scammers. According to the government’s assessment, this could allow criminals to gain access to other applications on the phone and potentially carry out financial fraud.
The activity is linked to a category of Android malware that cybersecurity researchers have referred to as “Android God Mode”, describing malware capable of gaining extensive control over a victim’s device.
India’s Growing Digital Footprint Raises the Stakes
The crackdown comes as India’s digital economy continues to expand at a remarkable pace. Nearly 242 billion transactions were processed through the country’s real-time payments system in the year to March 2026, making India one of the world’s largest digital payments markets.
That scale has also made the country an increasingly attractive target for cybercriminals. Government data cited by Reuters shows that Indians lost nearly $2.4 billion to alleged cyber fraud in 2025.
The government has traditionally responded by ordering the removal of fraudulent websites and blocking access to scam infrastructure. The increasing use of mainstream cloud and development platforms, however, adds another layer to the challenge.
Focus Shifts From Scam Websites to the Infrastructure Behind Them
The latest Firebase action indicates that authorities are increasingly looking beyond individual fraudulent websites to identify the infrastructure supporting wider scam operations.
For technology platforms, this creates a difficult balancing act. Services such as Firebase are designed to provide developers with accessible tools for building and deploying applications at scale. At the same time, the same accessibility can be exploited by criminals.
Google said it works with law enforcement agencies to evaluate reports and take action against violations of its policies.
For users, the developments underline the importance of exercising caution when downloading applications or following links received through messages, social media or unsolicited offers. The I4C has previously warned that malicious applications can impersonate trusted banking, government and utility services and trick users into installing them through fraudulent links.
As India continues to expand its digital payments and online services ecosystem, disrupting the infrastructure used to facilitate fraud is likely to become an increasingly important part of the country’s cybersecurity strategy.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram