BENGALURU, India | August 22, 2026
The Google Firebase scam has triggered a major cybersecurity crackdown in India after authorities detected criminals using Google’s popular app and website development platform to impersonate leading banks, distribute Android malware and steal sensitive financial information.
The Indian Cyber Crime Coordination Centre, or I4C, has directed Google to remove hundreds of accounts linked to suspicious activity on Firebase as investigators increasingly identify the platform being misused by cybercriminal networks.
In August alone, authorities issued takedown directions covering at least 57 Firebase-hosted websites and databases allegedly connected to phishing, malware distribution and financial fraud.
Some fraudulent pages were designed to look like websites or services linked to major Indian banks, including State Bank of India, ICICI Bank and Axis Bank.
The scams particularly targeted Android smartphone users.
Fake Bank Offers Used to Trap Android Users
Cybercriminals are allegedly using attractive banking offers to persuade victims to install malicious applications.
Users may receive messages or links claiming to offer:
- New credit cards
- Credit limit upgrades
- Reward-point redemption
- Banking account updates
- Government benefit payments
The links can lead to apps or pages that appear genuine.
However, once installed, the malicious software can begin collecting sensitive data from the victim’s device.
Authorities have warned that such malware can access financial information, credit-card details, one-time passwords and other personal data.
In more serious cases, attackers may gain extensive control over the victim’s smartphone.
SBI, ICICI Bank and Axis Bank Names Misused
Among the 57 Firebase-hosted websites and databases targeted for removal in August, seven were identified as phishing pages impersonating major Indian banks.
These included pages designed to resemble services associated with State Bank of India, ICICI Bank and Axis Bank.
The banks themselves are not accused of involvement in the scams.
Instead, fraudsters use the reputation and branding of trusted financial institutions to make fake websites and applications appear authentic.
Once victims believe they are interacting with their bank, they may be more likely to submit card information, passwords, account details or OTPs.
This is a common cybercrime technique known as phishing.
What Is Google Firebase?
Firebase is a Google-owned cloud platform widely used by developers to build mobile applications, websites and online services.
It provides tools for hosting, databases, authentication, analytics and application development.
Millions of legitimate developers use Firebase around the world.
However, Indian cyber investigators have observed that criminal groups are increasingly exploiting some of those same tools to host fraudulent pages and store data stolen from victims.
Authorities believe scammers have been shifting toward Firebase from other free online platforms because it offers accessible development tools and database capabilities.
There is no suggestion that Google or Firebase created or supported the fraudulent schemes.
Google has said it prohibits phishing, malware and financial fraud on its services and works with law-enforcement agencies when abuse is identified.
What Is ‘Android God Mode’ Malware?
One of the most dangerous elements of the scam involves a type of malicious activity sometimes described by cybersecurity researchers as “Android God Mode.”
The term refers to malware capable of gaining extremely broad access to a victim’s Android smartphone.
A malicious app may initially appear harmless or legitimate.
For example, it might present itself as:
- A banking application
- Government welfare app
- Utility service
- Credit-card application
- Reward redemption tool
Once installed and granted permissions, however, the malware can potentially access information stored on the phone.
Depending on the permissions obtained, attackers may attempt to capture messages, OTPs and banking information or interact with other applications.
This can allow fraudsters to move from simply stealing information to directly targeting money in victims’ accounts.
PM-KISAN Scam Also Detected
Bank customers are not the only targets.
Cybercriminals have also allegedly attempted to exploit PM-KISAN, the central government scheme that provides financial support to eligible farmers.
Fraudulent websites have reportedly offered users assistance in claiming or redeeming payments under the scheme.
Victims are then encouraged to download an application.
Instead of helping them obtain government benefits, the malicious application can transmit data from the phone to databases controlled by scammers.
The use of government schemes is particularly dangerous because people may trust messages that appear to be associated with official welfare payments.
India’s Huge Digital Payments Market Attracts Scammers
India’s rapid shift toward digital payments has created enormous opportunities for consumers and businesses, but it has also attracted increasingly sophisticated cybercriminal networks.
Nearly 242 billion transactions were processed through India’s real-time payments ecosystem in the year ended March 2026.
That enormous scale makes India one of the largest digital payments markets in the world.
Criminal groups are attempting to exploit this growth through phishing links, malicious mobile applications, fake investment schemes, impersonation scams and social engineering.
Cyber fraud has already become a major financial threat.
Government data shows Indians lost nearly $2.4 billion to alleged cyber fraud during 2025.
Google Says It Has Strict Anti-Abuse Policies
Google has maintained that it has strict rules prohibiting misuse of its services for phishing, malware and financial fraud.
The company also works with law-enforcement authorities, including I4C, to review and act on valid takedown requests.
Under applicable rules, online intermediaries may be required to remove specifically identified illegal or fraudulent content after receiving government notification.
The latest crackdown demonstrates how quickly cloud infrastructure can become part of cybercrime investigations when criminals exploit legitimate technology platforms.
Why Firebase Is Attractive to Cybercriminals
Cybercrime networks constantly adapt when websites, phone numbers or social-media accounts are blocked.
Free or inexpensive cloud platforms can allow scammers to rebuild infrastructure quickly.
Firebase offers features intended to make app development easier for legitimate developers.
Those same capabilities can potentially be abused to:
- Host phishing pages
- Create fake application interfaces
- Store stolen user information
- Connect malicious apps to remote databases
- Rapidly replace blocked scam infrastructure
Authorities are therefore focusing not only on individual phishing pages but also on the infrastructure behind them.
How Android Users Can Protect Their Bank Accounts
Users should be particularly cautious when receiving unexpected messages involving credit cards, rewards, government benefits or banking upgrades.
Never install APK files from unknown links
Banks generally do not ask customers to download applications through random WhatsApp, SMS, Telegram or email links.
Use the official Google Play Store and verify the developer before installing any financial application.
Never share OTPs
Banks, payment companies and government agencies do not require customers to disclose OTPs to unknown callers or through unofficial websites.
Check website addresses carefully
Fraudulent websites often copy logos and branding from legitimate banks.
A familiar logo does not prove that a website is genuine.
Be suspicious of urgent offers
Messages such as “redeem your rewards immediately,” “your card will be blocked,” or “upgrade your credit limit now” are commonly used to pressure users into clicking malicious links.
Review Android permissions
A banking or benefit-related application requesting unnecessary access to SMS messages, contacts, accessibility controls or device administration should be treated with caution.
Report financial cyber fraud quickly
Victims of financial cyber fraud in India can call the national 1930 cybercrime helpline and report incidents through the National Cyber Crime Reporting Portal.
Fast reporting can improve the chances of preventing fraudulent funds from being transferred further through mule accounts.
India Intensifies Fight Against Cyber Financial Fraud
The Firebase investigation is part of a much broader campaign by Indian authorities against online financial crime.
I4C has expanded cooperation with banks, payment companies, telecom operators and technology platforms to identify suspicious accounts and stop fraudulent transactions.
Authorities have also created systems for identifying mule bank accounts — accounts used by criminals to receive and move stolen funds.
Cybersecurity agencies increasingly emphasize that financial fraud cannot be addressed only after money has been stolen.
Instead, the approach is moving toward disrupting fraudulent websites, malicious applications, mule accounts, telecom connections and digital infrastructure before they can reach large numbers of victims.
Firebase Scam Shows How Cybercrime Is Evolving
The Google Firebase scam investigation highlights a major shift in India’s cybercrime landscape.
Fraudsters are no longer relying only on crude fake websites or suspicious phone calls.
They are increasingly using legitimate cloud infrastructure, sophisticated Android malware and convincing replicas of trusted financial services.
For consumers, that means familiar logos and professional-looking websites can no longer be treated as proof that a service is genuine.
For technology companies and law-enforcement agencies, the challenge is equally significant: identifying criminal infrastructure quickly enough to disrupt scams before thousands of users are targeted.
As India’s digital economy grows, the battle between cybercriminals and cybersecurity authorities is likely to become increasingly sophisticated.
For Android users, one rule remains particularly important: never install a banking, government or financial application from an unsolicited link, no matter how convincing the message appears.
