Generated with Google’s Nano Banana 2.
ESET found 28 CallPhantom scam apps on Google Play that promised fake call logs and had reached more than 7.3 million downloads before being removed.
A Google Play scam sold users the fantasy of peeking at someone else’s call history. The records were fake, but the payments were real.
ESET Research said it found 28 fraudulent Android apps, collectively known as CallPhantom, that claimed to retrieve call logs, SMS records, and WhatsApp call history for any phone number. The apps had been downloaded more than 7.3 million times before Google removed them from Google Play.
The case is a reminder that scam apps do not need sophisticated hacking tools to reach users at scale. CallPhantom relied on a familiar app-store setting, an invasive-sounding service, and a payment prompt.
The app names did much of the work. Listings such as “Call History of Any Number” made the offer instantly understandable, packaging access to private records as a simple mobile utility.
Screenshots helped sell the illusion. In one Google Play listing, the app appeared to show call-history results as proof of functionality, but ESET researcher Lukáš Štefanko, who uncovered the fraud, said the records were invented.
“Unsurprisingly, our analysis showed that the ‘call history’ data provided by this app is entirely fabricated,” Štefanko said. The app generated random phone numbers and paired them with fixed names, call times, and call durations embedded in the code.
The listings also had warning signs in plain view. Victims left negative reviews accusing the apps of scamming them, while some glowing reviews appeared to be fake. The store pages had just enough polish to make the scam look worth trying.
Some CallPhantom apps teased users with partial results before asking them to pay for the full history. Others asked for an email address where the records would supposedly be sent, but payment still came first.
ESET found three payment paths across the apps. Some used Google Play subscriptions, while others routed users through third-party apps that support UPI, a payment system used mainly in India. In some cases, the apps embedded payment card checkout forms directly inside the app.
Google Play subscriptions were canceled after removal, but outside payments were harder to reverse. Google could not cancel or refund those purchases, so users had to contact their payment provider or the app developer.
Charges varied widely. The highest requested price was $80, while the lowest subscription tier averaged about €5.
A small group of apps carried much of the total:
Several others reached the tens or hundreds of thousands, making the campaign broader than the top five listings alone.
The reach also had a regional pattern. The apps mainly targeted Android users in India and the broader Asia-Pacific region, with many preselecting India’s +91 country code.
CallPhantom’s trick was making an impossible service look ordinary. No legitimate Android app can pull someone else’s private records on demand, and any app that says otherwise is selling the scam before the payment screen even appears.
Also read: Rumored Android 17 features suggest Google is preparing a more ambitious release than a routine OS refresh.
Liz Ticong is a staff writer for eWeek and TechRepublic focused on AI, cybersecurity, enterprise software, and data. She has more than 10 years of editorial experience as a technology industry writer, combining reporting, product research, and hands-on software testing in her coverage. Her work has been published on Datamation, Enterprise Networking Planet, and TechnologyAdvice.com. She writes technology news, software reviews, product comparisons, and buyer’s guides for business and IT readers.
