India Orders Google to Remove Firebase Accounts Used in Banking Scams

Indian authorities have directed Google to take down numerous websites and accounts hosted on its Firebase platform, which were being exploited by scammers. The Indian Cyber Crime Coordination Centre (I4C) identified at least 57 websites and databases on Firebase in August alone that were distributing malware and attempting to steal sensitive financial data from victims.

Government notices reveal that Android-based malware was disguised as legitimate banking applications. These fraudulent apps targeted users with enticing offers, such as new credit cards or increased credit limits, to trick them into revealing financial information. The notices specifically mentioned that seven of the identified sites in August were phishing pages designed to mimic major Indian banks like State Bank of India, ICICI Bank, and Axis Bank.

Google maintains strict policies against the use of its services for phishing, malware, and financial fraud. The company stated it collaborates with law enforcement agencies, including the I4C, to address removal requests. The notices did not suggest Google or Firebase were complicit in the scams but warned Google could be held liable for the identified links if they were not removed within three hours.

According to a source familiar with the matter, Indian authorities have issued numerous similar notices to Google in recent months as scammers increasingly shift their operations to Firebase. The platform's free services and database features are attractive to fraud networks. These scams often involve persuading victims to download applications that appear legitimate, which then transmit their device information to scammer-controlled databases. One scheme even exploited the PM-KISAN government program for farmers, promising assistance with payments and instructing beneficiaries to download a malicious application.