India has ordered Google to take down at least 57 websites and databases hosted on its Firebase platform in August after officials found they were allegedly being used for phishing, malware distribution and financial fraud.

The action has brought attention to Firebase, a Google platform widely used by developers to build and host apps and websites. But what exactly is Firebase, and how are scammers using it?

What is Firebase used for?

Firebase is a platform from Google that helps developers build, run and manage apps and websites. It offers tools for functions such as hosting websites, storing data, authentication, analytics and managing app-related services.

It is used by millions of developers worldwide and is part of Google’s cloud business.

Firebase itself is a legitimate development platform. The Indian government’s action is focused on websites and databases that officials say were misused by scammers, rather than suggesting that Google or Firebase was responsible for the fraud.

How were scammers using Firebase?

According to notices sent by India’s Indian Cyber Crime Coordination Centre (I4C) to Google, scammers were using Firebase-hosted websites to impersonate major banks and distribute malicious Android apps.

Some phishing pages allegedly mimicked banks such as State Bank of India, ICICI Bank and Axis Bank. The notices said other Firebase-hosted websites were being used to collect data stolen from victims’ phones, including credit card details and one-time passwords.

In one reported scheme, scammers allegedly used fake websites offering help with PM-KISAN payments to persuade people to download an app. The malicious app could then send information from the victim’s phone to a Firebase database controlled by the scammers.

Is Firebase a backend or database?

Firebase can provide both backend services and database services.

It is often described as a backend-as-a-service platform because it provides developers with ready-made tools and infrastructure that can handle parts of an app’s backend without requiring them to build everything from scratch.

It also offers databases, including services that allow developers to store and synchronise app data.

This is why Firebase can be useful to legitimate developers but can also be abused by criminals. In the cases flagged by I4C, officials said scammers were using Firebase’s legitimate infrastructure to support fraudulent operations.

Can Firebase be used for free?

Yes. Firebase offers free usage options for several of its services, although the limits and pricing depend on the specific service and usage.

The availability of free options has also made the platform attractive to developers. According to a source familiar with the Indian government’s assessment, scammers have increasingly shifted to Firebase from other free tools because of its free options and database capabilities.

However, using Firebase does not mean an app or website is automatically trustworthy. Users should still be cautious about links asking them to download apps, enter banking details, card information or one-time passwords.

Is Firebase blocked in India?

No. The Indian government’s action does not amount to a blanket ban on Firebase in India.

The notices reviewed by Reuters targeted specific Firebase-hosted websites and databases that officials alleged were being used for cybercrime.

Google said it has strict policies against using its services for phishing, malware and financial fraud, and that it works with law enforcement agencies, including I4C, to assess and act on such notices.

The crackdown highlights a broader challenge for online platforms: legitimate digital services can be misused by criminals to make scams appear more credible and harder for users to identify.

What should users watch out for?

The government has warned about malicious apps that impersonate trusted services such as banks, government schemes and utility providers.

Users should be particularly cautious about links that ask them to download an app, claim a reward or payment, or request sensitive information such as banking credentials, card details or OTPs.

The bigger takeaway is that the presence of a website or app on a familiar technology platform does not by itself prove that it is legitimate.