A Google Play scam sold users the fantasy of peeking at someone else’s call history. The records were fake, but the payments were real.
ESET Research said it found 28 fraudulent Android apps, collectively known as CallPhantom, that claimed to retrieve call logs, SMS records, and WhatsApp call history for any phone number. The apps had been downloaded more than 7.3 million times before Google removed them from Google Play.
The case is a reminder that scam apps do not need sophisticated hacking tools to reach users at scale. CallPhantom relied on a familiar app-store setting, an invasive-sounding service, and a payment prompt.
How CallPhantom turned curiosity into a scam
The app names did much of the work. Listings such as “Call History of Any Number” made the offer instantly understandable, packaging access to private records as a simple mobile utility.
Screenshots helped sell the illusion. In one Google Play listing, the app appeared to show call-history results as proof of functionality, but ESET researcher Lukáš Štefanko, who uncovered the fraud, said the records were invented.
“Unsurprisingly, our analysis showed that the ‘call history’ data provided by this app is entirely fabricated,” Štefanko said. The app generated random phone numbers and paired them with fixed names, call times, and call durations embedded in the code.
The listings also had warning signs in plain view. Victims left negative reviews accusing the apps of scamming them, while some glowing reviews appeared to be fake. The store pages had just enough polish to make the scam look worth trying.
Users paid for info the apps never had
Some CallPhantom apps teased users with partial results before asking them to pay for the full history. Others asked for an email address where the records would supposedly be sent, but payment still came first.
ESET found three payment paths across the apps. Some used Google Play subscriptions, while others routed users through third-party apps that support UPI, a payment system used mainly in India. In some cases, the apps embedded payment card checkout forms directly inside the app.
Google Play subscriptions were canceled after removal, but outside payments were harder to reverse. Google could not cancel or refund those purchases, so users had to contact their payment provider or the app developer.
Charges varied widely. The highest requested price was $80, while the lowest subscription tier averaged about €5.
More Google coverage
- New Google Search AI Mode is ‘Total Reimagining,’ Says CEO Sundar Pichai
- In Major Ruling, Judge Finds Google ‘Willfully Acquired and Maintained Monopoly Power’ Over Digital Ad Market
- Google’s Big Bet on Nuclear Energy: ‘The Race to Power AI-Driven Data Centers is Accelerating’
- Computer History Museum Releases Original AlexNet Code: Why It Matters
A few titles drove millions of installs
A small group of apps carried much of the total:
- Call history : any number deta: 3M+ downloads
- Call History of Any Number: 1M+ downloads
- Call Details of Any Number: 1M+ downloads
- Call History Any Number Detail: 500K+ downloads
- Call History Of Any Number: 500K+ downloads
Several others reached the tens or hundreds of thousands, making the campaign broader than the top five listings alone.
The reach also had a regional pattern. The apps mainly targeted Android users in India and the broader Asia-Pacific region, with many preselecting India’s +91 country code.
CallPhantom’s trick was making an impossible service look ordinary. No legitimate Android app can pull someone else’s private records on demand, and any app that says otherwise is selling the scam before the payment screen even appears.
Also read: Rumored Android 17 features suggest Google is preparing a more ambitious release than a routine OS refresh.