India Tells Google to Remove Firebase-Hosted Bank Scam Infrastructure

Indian cybercrime officials linked at least 57 Firebase-hosted websites and databases to bank impersonation, malicious Android apps, and stolen financial data. Here is what the evidence says—and what Android users should do.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Original illustration of a civic building and red threat nodes separated by a glowing shield from a neutral cloud network.
The reported action targets alleged scam infrastructure hosted on a legitimate cloud platform; Google and Firebase were not accused of responsibility.

Reporting cutoff: August 26, 2026 at 19:26 UTC. Freshness check: Reuters’ report remains indexed at its original URL, and the cited official Firebase, Hosting, Play Protect and Indian cybercrime-reporting pages were live when rechecked. No later authoritative update changing the documented scope was located.

What happened

India’s cybercrime coordination agency told Google to remove Firebase-hosted websites and databases that officials linked to bank impersonation, malicious Android apps and financial-data theft.[1]

Reuters documents at least 57 websites and databases targeted in August. That is more precise than headlines that collapse websites, databases, projects and Google accounts into one “hundreds of accounts” figure.[1]

The 30-second version

Specific resources

The action targets alleged scam infrastructure—not Firebase as a whole.

Hosting is not endorsement

A web.app address or padlock does not prove a bank authorized the page.

Never sideload banking apps

Use the bank’s known site and official Play listing, not a link in a message or offer.

What investigators described

Seven of the 57 named resources were phishing pages that mimicked State Bank of India, ICICI Bank and Axis Bank. The others were described as sites or databases that received information stolen from infected phones, including card details and one-time passwords.[1]

Lures included new cards, reward redemptions, credit-limit upgrades and a fraudulent PM-KISAN benefit flow. Victims were pushed to install Android apps that looked legitimate but sent information to scam-controlled infrastructure.[1]

Why Firebase was involved

Firebase is a legitimate Google-backed development platform used by millions of businesses for applications, authentication, databases, storage and hosting.[2] Firebase Hosting can deploy static and single-page web apps through a global content-delivery network.[3]

Those capabilities are useful to real developers and can also be abused by criminals. Google hosting says where content runs—not who endorses it.

Google was not accused

Reuters says the notices did not suggest Google or Firebase was responsible. Google said it prohibits phishing, malware and financial fraud and works with I4C and other law-enforcement agencies to evaluate notices.[1]

What Android users should do

  • Never install a banking APK from SMS, WhatsApp, Telegram, email, an advertisement or a reward page.
  • Reach the official Play listing from the bank’s known website.
  • Keep Play Protect enabled; Google says it checks apps from Play and other sources for harmful behavior.[5]
  • Never reveal passwords, PINs, card details or one-time codes to an unexpected sender.
  • If compromise is suspected, stop using the affected phone for banking and contact the bank from a different, trusted device.
  • Preserve the suspicious message, URL, app name and useful screenshots without reopening the link. Seek device-specific professional guidance before deleting apps or resetting the phone: Google warns that a factory reset erases all data and recommends trying other solutions first.[7]

Reporting suspicious infrastructure

Google provides a Cloud Platform abuse-report form for suspicious URLs and technical evidence.[4] India’s National Cyber Crime Reporting Portal lets citizens report suspect URLs and other identifiers.[6]

What remains unknown

  • The exact number of Google accounts or Firebase projects disabled
  • Whether every named resource has been removed
  • Total victims and campaign-specific losses
  • The operators and whether all resources belonged to one group
  • How many malicious APKs remain in circulation

The defensible conclusion is that India directed takedowns of specific Firebase-hosted resources linked by I4C to banking impersonation and Android malware—not that India ordered Firebase shut down.

Sources

  1. Reuters — India orders removal of Google Firebase accounts after spotting scam pattern
  2. Google Firebase product overview
  3. Firebase Hosting documentation
  4. Google Cloud abuse-report form
  5. Google Play Protect guidance
  6. India National Cyber Crime Reporting Portal
  7. Android Help — Reset your Android device to factory settings

This article contains no malicious URLs, malware samples, stolen financial information, victim identities or account credentials.

Browse Articles

Latest Articles