India orders Google to pull hundreds of Firebase accounts tied to bank fraud

India’s cybercrime agency has ordered Google to shut down hundreds of accounts on Firebase, the tech giant’s app building platform, after multiple fake banking apps and phishing sites were traced back to the service.

The Indian Cyber Crime Coordination Center (I4C) sent Google at least three notices in August, naming at least 57 websites and databases in total that all run on Firebase. These sent notices claimed the links were being used as tools for spreading malware and pulling financial data off victims’ devices.

Of these 57 websites and databases, seven were phishing pages built to closely resemble login screens of major Indian banks, including the State Bank of India, ICICI Bank, and Axis Bank. Officials described the others as collection points for stolen information like credit card numbers and one-time passwords.

Credit card scam method

According to an August 17 notice, scammers wrote Android malware camouflaged as real banking apps and went after cardholders specifically. The bait was regular financial temptation, including a new credit card, a reward to redeem, and a higher credit limit.

A victim who fell for the malware scam installed what looked like a bank’s app. Once on the phone, the software quietly forwarded data to a Firebase database controlled by the scammers. This gave the scammers a route into other apps on the device and, potentially, into the victim’s money.

Officials identified one scheme built around PM-KISAN, the federal program that pays small farmers directly. Fake sites promised to help recipients claim their money and told them to download an app to collect these funds. That app also siphoned user data straight to the attackers.

India’s crackdown on Firebase infrastructure

India had over 242 billion transactions occur via its real-time payments system from January 2026 to March 2026. This huge foundation gives fraudsters the chance to acquire a massive pool of targets within the country.

Firebase is used by millions of developers globally, as it is quite easily accessible. Criminals have also taken advantage of this, moving onto the platform from other free tools over the past year due to its free tier and database features.

The Indian government’s standard response to such fraudulent schemes has simply been to track down the scam websites and disable them. However, the new steps point to a more expansive approach aimed at the infrastructure supporting the schemes.