India orders Google to remove Firebase-hosted phishing sites targeting banks
India has ordered Google to take down 57 Firebase-hosted websites and databases allegedly used for phishing, malware and impersonation of banks and government services. The action underscores rising fraud risks across India’s fast-growing digital-payments ecosystem.
What happened
Google Firebase · India ordered Google to remove Firebase-hosted phishing and malware sites allegedly impersonating banks and government services. The crackdown
Key facts
- 57 Firebase-hosted websites and databases ordered removed in August
- Google faces potential liability if specified links are not removed within 3 hours
- 7 of the 57 flagged sites allegedly mimicked Indian banks
- India lost nearly $2.4 billion to alleged cyber fraud in 2025
- Nearly 242 billion digital transactions were processed in India in the year to March 2026
Why this matters
Banks, retailers and payment platforms should prioritize partnerships or acquisitions in fraud detection, identity verification and threat-intelligence tools while intensifying cybersecurity diligence on digital-payment targets.
What to watch
- Additional Indian government orders targeting cloud hosts, app stores, messaging platforms or domain registrars.
- Mandated takedown timelines, platform due-diligence rules, or expanded cyber-incident reporting requirements.
- A disclosed bank, wallet or major retailer loss event tied to Firebase-hosted phishing.
- Rising payment failure, OTP-reset, chargeback or account-takeover rates following stricter authentication controls.
- Evidence of scam migration toward QR payments, mule accounts, SIM swaps, deepfake support calls or compromised merchant sites.
- Require payment vendors and checkout partners to document phishing-response SLAs, fraud-loss liability and escalation contacts.
- Increase customer-facing verification cues: official-domain education, in-app alerts, transaction-contextual warnings and verified support-channel messaging.
- Deploy real-time controls for high-risk payment events, including new-device logins, beneficiary additions, OTP resets and unusual refund or gift-card activity.
- Audit Firebase and other cloud-service dependencies for brand impersonation exposure; establish continuous monitoring and rapid takedown workflows.
- Prepare for increased false positives by improving manual-review capacity and customer-service scripts for blocked or challenged transactions.