India Orders Google to Shut Scam-Linked Firebase Accounts

The Indian government has directed Google to shut down hundreds of accounts, websites and databases on its Firebase development platform after authorities identified a growing pattern of cybercriminals using the infrastructure for banking and financial scams. 

The Indian Cyber Crime Coordination Centre (I4C) ordered at least 57 Firebase-hosted websites and databases to be taken down in August alone. Authorities said some were being used to distribute Android malware and capture sensitive financial information, including credit-card details and one-time passwords. 

Seven of the identified phishing sites reportedly impersonated major Indian banks, including State Bank of India, ICICI Bank and Axis Bank. Fraudsters used offers such as new credit cards, reward redemptions and credit-limit upgrades to lure victims toward malicious applications. 

Another campaign reportedly impersonated the government's PM-KISAN scheme, demonstrating how attackers are combining trusted brands, government programs and legitimate cloud infrastructure to make malicious applications appear credible. 

Trusted Cloud Infrastructure Becomes the Attack Surface

The bigger cybersecurity issue is that criminals no longer need obviously suspicious infrastructure. Platforms such as Firebase provide legitimate hosting, databases and development capabilities used by millions of developers. Attackers can abuse that trust to make phishing campaigns harder for ordinary users to recognize.

The development also reinforces why banks must look beyond blocking fraudulent URLs. Device intelligence, behavioral analytics, malware detection, transaction monitoring and continuous customer verification are increasingly necessary because the attack may begin outside the banking environment but ultimately target financial credentials and transactions.

With India processing enormous volumes of digital payments, trusted cloud platforms are becoming attractive infrastructure for industrialized fraud. The security challenge is therefore shifting from simply asking “Is this website suspicious?” to “Is this trusted infrastructure being used for suspicious behavior?”

The government's action sends an important message: cloud platforms, banks, telecom operators and law-enforcement agencies will increasingly need real-time intelligence sharing and rapid takedown mechanisms to disrupt cybercrime before stolen data becomes stolen money.