India's Indian Cyber Crime Coordination Centre (I4C) has directed Google to remove hundreds of accounts on its Firebase platform after authorities identified criminals systematically using the service to run phishing operations against bank customers.
I4C directed Google to remove at least 57 websites and databases hosted on Firebase in August alone. Reuters reviewed three government notices sent by I4C to Google in August, accessed through Lumen, a non-profit database where companies like Google voluntarily submit content removal requests they receive.
Seven of the 57 flagged websites mimicked major Indian banks, including State Bank of India, ICICI Bank and Axis Bank, while others were allegedly designed to collect stolen information such as credit-card details and one-time passwords.
Scammers lured victims with promotional offers such as reward redemptions, credit card limit upgrades, or fake government benefit distributions. Once users clicked the links, malicious Android applications infected their devices to capture sensitive credentials, OTPs, and credit card details, sending the stolen data directly to Firebase databases controlled by the perpetrators.
Officials also identified a scheme built around PM-KISAN, the federal programme that pays small farmers directly. Fake sites promised to help recipients claim their money and told them to download an app which also siphoned user data straight to the attackers.
Firebase is used by millions of developers globally and is easily accessible. Criminals have taken advantage of this, moving onto the platform from other free tools over the past year due to its free tier and database features.
Google can face liability for the named links if they are not removed within three hours of receiving a notice. Google said it has strict policies against phishing, malware and financial fraud and works with law-enforcement agencies, including I4C, to assess and act on removal requests. The government notices did not suggest that Google or Firebase was responsible for the scams.
Online scams have become one of India's most pressing law enforcement challenges, with Indians losing nearly $2.4 billion in alleged cyber fraud in 2025, according to government data. The move signals India is now targeting the infrastructure behind scams, not just individual scam websites.
