India has directed Google to shut down hundreds of accounts on its Firebase web development platform after uncovering a systematic pattern of criminals using the service to impersonate major banks and defraud citizens, according to government notices and sources familiar with the matter.

India's Indian Cybercrime Coordination Centre (I4C) identified the scam pattern in August, finding that criminals were using Firebase to host phishing pages that mimicked the websites and login portals of top Indian banks including State Bank of India (SBI) and ICICI Bank. The phishing sites were also impersonating fintech staff to lure victims.

The Indian government issued three separate notices to Google over the operation in August alone. The fraudulent accounts were being used to create convincing fake banking portals where victims were tricked into entering login credentials and financial information.

Firebase, Google's popular web development and hosting platform, has become an increasingly common vector for phishing operations due to its free tier, ease of setup, and the legitimacy lent by Google's domain infrastructure. The crackdown reflects a broader trend of governments pressuring cloud and platform providers to take faster action against abuse of their services.

Google has not publicly commented on the specific takedown orders. The incident underscores the ongoing tension between platform accessibility and the ease with which developer tools can be weaponized for fraud at scale.

Sources