Fake Bank Apps, Stolen OTPs: Why India Is Targeting Google Firebase

India has directed Google to shut down hundreds of accounts on its Firebase web development platform after authorities found a pattern of scammers using the service to impersonate banks and defraud people, according to a Reuters report.

The Indian Cyber Crime Coordination Centre (I4C) directed Google to remove at least 57 websites and databases hosted on Firebase in August, according to government notices reviewed by Reuters. The sites were allegedly being used to distribute malware and steal sensitive financial information from victims’ phones.

There was no suggestion in the notices that Google or Firebase was responsible for the scams. However, Google can be held liable for the specified links if they are not removed within three hours of receiving a notice.

How Scammers Used Firebase

According to an August 17 notice, scammers were using Android-based malware that appeared to be legitimate banking services. Victims were reportedly targeted with offers such as new credit cards, reward redemptions and credit-limit upgrades.

Seven of the 57 websites flagged by I4C were phishing pages that allegedly copied the look of major Indian banks, including State Bank of India, ICICI Bank and Axis Bank. The remaining sites were described as platforms used to collect data stolen from victims’ phones, including credit card details and one-time passwords.

The scams also extended beyond banking. One scheme allegedly used the PM-KISAN government programme to lure victims. Websites promised users help in claiming their payment and asked them to download an app to receive the money.

Once installed, the malicious app could send users’ data to a Firebase database controlled by scammers. This could give them access to other apps on the victim’s phone and potentially allow them to steal funds.

Google Responds As Cyber Fraud Rises

Google said it has strict policies against using its services for phishing, malware and financial fraud. The company added that it works with law enforcement agencies, including I4C, to assess and act on removal requests.

Firebase is used by millions of developers worldwide to build applications and host websites. Scammers have increasingly shifted to the platform from other free tools since last year, attracted by its free options and database features, according to the report.

The action comes as online fraud remains a major challenge in India. Indians lost nearly $2.4 billion in alleged cyber fraud in 2025, according to government data cited by the news agency.

India’s large digital payments ecosystem has also become an attractive target. Nearly 242 billion digital transactions were processed through the country’s real-time payments system in the year to March 2026.

The government issued a public advisory in March warning about malicious apps that impersonate banking, government and utility services. Such malware can give scammers extensive control over victims’ phones and allow them to access sensitive information.