Google ordered to take down Firebase pages impersonating banks, financial institutions

The Central government has reportedly asked Google to take down Firebase accounts impersonating banks and financial institutions. I4C flagged 57 pages, including phishing sites allegedly used to steal credit card details and OTPs and defraud users.

New Delhi: The Central government has reportedly directed Google to take down multiple Firebase web development accounts that were impersonating the websites and mobile apps of major public and private-sector banks and other financial institutions.

Notices were sent by the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs after investigators found sites and databases mimicking Android apps of banks, multiple reports said.

---

These sites were used to defraud users through fake reward‑point redemption offers and credit‑card limit upgrades.

A Google spokesperson responded to the government notice, saying that the company had “strict policies” prohibiting the use of its services for “phishing, malware, or financial fraud”.

“We are deeply committed to user safety and work closely with law enforcement and government agencies in India, including I4C. To that end, we evaluate and action all government notices according to our standard procedures and applicable laws,” the spokesperson said.

Firebase platform, part of Google Cloud, is widely used to develop and host mobile apps and websites, and seven of the 57 Firebase pages flagged in the notices were phishing pages, impersonating banks such as State Bank of India, ICICI Bank and Axis Bank.

Other sites were used to allegedly collect data stolen from victims’ phones, including credit‑card details and one‑time passwords.

As per government data, Indian users lost Rs 22,500 crore to digital and cyber fraud in 2025 alone, and close to Rs 52,000 crore over the past five years.

The takedown requests come amid a broader regulatory push to curb digital‑payment frauds. The Reserve Bank of India’s fraud-prevention measures include authentication and system‑security widened to allow alternative authentication methods.

The RBI’s digital-payment security directions prescribe minimum standards to protect customer and payment data.

Further, it announced a compensation mechanism for small‑value fraudulent transactions, with a one-time payment of up to Rs 25,000 for eligible victims who lost up to Rs 50,000.