India has ordered Google to remove dozens of accounts and websites hosted on its Firebase platform after authorities identified their use in online banking scams and malware attacks.
The Indian Cyber Crime Coordination Centre (I4C) directed Google to take down at least 57 Firebase-hosted websites and databases in August, according to government notices reviewed by Reuters.
Authorities said the platforms were being used to distribute malicious software and steal sensitive financial information from victims’ mobile phones.
One notice issued on 17 August said scammers were using Android malware disguised as legitimate banking services to target users with offers involving credit cards, rewards and increased credit limits.
Seven of the websites identified by authorities reportedly imitated major Indian banks, including State Bank of India, ICICI Bank and Axis Bank. Others were allegedly used to store information stolen from victims, including credit card details and one-time passwords.
The government said scammers had increasingly shifted to Firebase from other free web development services, attracted by its free features and database capabilities.
Digital Fraud Raises Concerns
India has experienced a sharp rise in cyber fraud as digital payments expand. Government data showed that Indians lost nearly $2.4 billion to alleged online scams in 2025.
Authorities have also warned about malicious apps that impersonate banking, government and utility services. Victims are often persuaded to download the apps through fraudulent links, allowing criminals to obtain sensitive information.
In one scheme, scammers allegedly used fake websites offering assistance with payments under the PM-KISAN government programme. Victims were directed to install an app, which then transmitted their data to databases controlled by the fraudsters.
READ ALSO:Â EU Probes Google Over AI Use of Online Content
Google said it prohibits the use of its services for phishing, malware and financial fraud and works with law enforcement agencies to investigate and act on removal requests.
There was no indication that Google or Firebase was involved in the scams. However, authorities can require the removal of identified links within a specified period.
The measures highlight growing efforts by Indian authorities to protect the country’s rapidly expanding digital payments ecosystem from online fraud.
