India orders Google to remove Firebase links used in cyber scams

NEW DELHI: The cloud has found a dark cloud of its own. The Indian government has directed Google to remove hundreds of accounts and links hosted on its Firebase platform after authorities detected cybercriminals using the service to impersonate banks and target consumers with financial scams, Reuters reported

The action comes as online fraud continues to rack up a hefty bill in India. Government data cited in the report shows that alleged online scams cost users nearly $2.4 billion in 2025, while authorities are now seeing scammers increasingly turn to legitimate cloud and app-development infrastructure to host malicious content

The Indian Cyber Crime Coordination Centre (I4C) ordered the removal of at least 57 Firebase-hosted websites and databases in August alone, saying they were being used to distribute malware and steal sensitive financial information. The notices, sent to Google and reviewed by Reuters, form part of a wider crackdown on fraudulent online operations

One of the notices highlighted how fraudsters were disguising Android malware as legitimate banking services and targeting credit card users. Victims were allegedly lured with offers around new credit cards, reward-point redemptions and credit-limit upgrades, before being directed to malicious links

The issue is not Firebase itself, but how its infrastructure is being exploited. Firebase is widely used by developers to build applications and host websites, making its scale, accessibility and trusted infrastructure attractive not only to legitimate users but also to scammers looking for a seemingly credible digital home

Authorities have not accused Google or Firebase of wrongdoing. However, the notices reportedly cite rules under which Google could face liability if flagged links are not removed within three hours of receiving a notice from authorities

People familiar with the matter told Reuters that notices involving alleged Firebase abuse have been issued repeatedly in recent months, suggesting the problem is becoming a recurring feature of India’s cybercrime landscape rather than a one-off abuse of the platform

Google said it maintains strict policies against phishing, malware distribution and financial fraud and works with law enforcement agencies, including I4C, to review and act on valid requests

The development also underlines a growing headache for regulators: cybercriminals are not necessarily building suspicious infrastructure from scratch. Instead, they can increasingly piggyback on legitimate digital tools and services, turning platforms designed to help businesses and developers build online products into launchpads for scams

For Indian consumers, that makes the familiar-looking link itself an increasingly unreliable sign of safety because in the cybercrime game, even the trusted cloud can sometimes carry dangerous baggage

Source: indiantelevision.com