Fake Call History Apps on Google Play Steal Payments From 7.3M+ Users

Key Takeaways

• A family of 28 fraudulent Android applications, collectively named CallPhantom, duped over 7.3 million users into paying for fabricated call history data.
• These apps, now removed from Google Play, promised to reveal any phone number’s call history but delivered only fake information.
• Victims primarily in India and the Asia-Pacific region incurred financial losses through various payment methods, some of which bypassed Google’s refund mechanisms.
• The deception was deeply embedded, with pre-programmed fake data and aggressive tactics to pressure users into subscriptions ranging up to $80.

Widespread Android Scam “CallPhantom” Defrauds Millions

A sophisticated network of 28 deceptive Android applications, identified as CallPhantom, successfully amassed over 7.3 million downloads on the Google Play Store before their eventual removal. These applications lured users with the enticing, yet false, promise of providing comprehensive call histories for any phone number. Instead, they delivered entirely fabricated data while siphoning payments from unsuspecting individuals, as detailed in a recent security analysis.

The scheme capitalized on human curiosity. Users seeking to uncover who had called a particular number were presented with what appeared to be partial call records. To access the “full” history, which was generated bogus data, users were then prompted to make a payment.

ESET Research Uncovers CallPhantom Operation

Researchers at WeLiveSecurity were instrumental in identifying and reporting these 28 malicious applications to Google. Their investigation revealed that the apps had collectively garnered more than 7.3 million downloads before Google took action to remove them following ESET’s disclosure in December 2025.

The primary target demographic for these applications was Android users in India and the broader Asia-Pacific region. Many of the apps featured India’s country code pre-selected and integrated support for UPI, a widely adopted payment system across India. The developers even included screenshots of the fabricated call history data within the apps’ Play Store listings, deceptively presenting them as genuine proof of functionality.

Deceptive Tactics and Payment Mechanisms

Despite superficial differences in their presentation, all 28 CallPhantom applications shared a common fraudulent core: generating fake communication data and coercing users into paying for access. Subscription tiers varied from weekly to yearly, with the most expensive option reaching $80.

The CallPhantom apps were categorized into two primary clusters based on their operational methods. The first group contained hardcoded names, country codes, and call log templates directly embedded within their application code. These pre-programmed elements were then combined with randomly generated phone numbers and displayed to users as tantalizing partial results, compelling them to pay for a complete, albeit fake, record.

The second cluster of applications required users to submit an email address, falsely claiming that the retrieved call history would be delivered to that inbox. No actual data was ever generated until after a payment was made, and even then, no legitimate information was ever dispatched. Crucially, these apps lacked any genuine capability to access call logs, SMS records, or WhatsApp data from any device.

This deep integration of fabricated data, including fixed names and timestamps, demonstrated a calculated effort to deceive users from the moment the app was installed.

The payment infrastructure employed by these apps involved three distinct methods. Some applications utilized Google Play’s official billing system. Others redirected users to third-party UPI applications, with payment details either hardcoded or dynamically fetched from a Firebase real-time database, allowing the operators to frequently change the receiving accounts. A third, more egregious method involved embedding payment card checkout forms directly within the app itself. This tactic circumvented Google Play’s payment policies and significantly complicated the process for victims seeking refunds.

Bypassing Refunds and Staying Under the Radar

A key strategy employed by CallPhantom operators was to direct users towards payment channels that Google could not easily reverse. When transactions were processed through external UPI applications or via direct card entry within the app, Google lacked the authority to cancel payments or issue refunds. This left victims entirely reliant on the third-party payment providers or, more often, the fraudulent developers themselves.

In at least one instance, the applications sent deceptive notifications disguised as email alerts, falsely claiming that call history results had arrived. Tapping these notifications would immediately lead the user to a subscription payment screen, maintaining pressure even if they had previously exited the app without purchasing.

What You Should Do

• Check for Refunds: If you subscribed through Google Play’s official billing system, you might be eligible for a refund, as subscriptions were canceled upon the apps’ removal. Submit a refund request within Google’s specified window.
• Dispute Charges: For purchases made outside of Google Play (e.g., via UPI or direct card entry), contact your payment provider or card issuer immediately to dispute the charges.
• Verify Developer Credibility: Before downloading any app, especially those promising access to sensitive or private information, thoroughly research the developer. Look for official websites, legitimate contact information, and a history of reputable applications.
• Read User Reviews Critically: Pay close attention to user reviews. Be wary of apps with generic positive reviews or those with a high number of negative reviews reporting similar issues (e.g., non-functional features, unexpected charges).
• Be Skeptical of Unrealistic Promises: Exercise extreme caution with applications that claim to provide access to private data belonging to other individuals (like call histories or private messages). Such claims are often indicative of a scam.
• Review App Permissions: Before installing, always review the permissions an app requests. If an app requests permissions that seem excessive or unrelated to its stated function, it could be a red flag.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.