Índia ordena desativação de centenas de contas Firebase do Google usadas em golpes bancários

A agência de crimes cibernéticos da Índia ordenou que o Google desative centenas de contas no Firebase, a plataforma de criação de aplicativos da gigante de tecnologia, após diversos aplicativos bancários falsos e sites de phishing terem sido rastreados até o serviço. O Centro Indiano de Coordenação de Crimes Cibernéticos (I4C) enviou ao Google pelo menos três notificações em agosto, citando um total de pelo menos 57 sites e bancos de dados que operam no Firebase. As notificações alegavam que os links estavam sendo usados como ferramentas para disseminar malware e extrair dados financeiros dos dispositivos das vítimas. Desses 57 sites e bancos de dados, sete eram páginas de phishing criadas para se assemelhar às telas de login dos principais bancos indianos, incluindo o State Bank of India, ICICI Bank e Axis Bank. Autoridades descreveram os demais como pontos de coleta de dados roubados.

Credit card scam method

According to an August 17 notice, scammers wrote Android malware camouflaged as real banking apps and went after cardholders specifically. The bait was regular financial temptation, including a new credit card, a reward to redeem, and a higher credit limit.

A victim who fell for the malware scam installed what looked like a bank’s app. Once on the phone, the software quietly forwarded data to a Firebase database controlled by the scammers. This gave the scammers a route into other apps on the device and, potentially, into the victim’s money.

Officials identified one scheme built around PM-KISAN, the federal program that pays small farmers directly. Fake sites promised to help recipients claim their money and told them to download an app to collect these funds. That app also siphoned user data straight to the attackers.

India’s crackdown on Firebase infrastructure

India had over 242 billion transactions occur via its real-time payments system from January 2026 to March 2026. This huge foundation gives fraudsters the chance to acquire a massive pool of targets within the country.

Firebase is used by millions of developers globally, as it is quite easily accessible. Criminals have also taken advantage of this, moving onto the platform from other free tools over the past year due to its free tier and database features.

The Indian government’s standard response to such fraudulent schemes has simply been to track down the scam websites and disable them. However, the new steps point to a more expansive approach aimed at the infrastructure supporting the schemes.