ESET Exposes CallPhantom Scam: 28 Fake Call‑History Apps With 7.3M Downloads Removed From Google Play

• ESET identified and reported 28 separate CallPhantom apps on Google Play, cumulatively downloaded more than 7.3 million times.
• 53.7% of all CallPhantom detections worldwide were found in India.Some CallPhantom apps sidestep Google Play’s official billing system, complicating victims’ refund efforts.

ESET researchers have uncovered fraudulent apps on Google Play that claim to provide the call history “for any number.” The offending apps, which ESET named CallPhantom based on their false claims, purport to provide access to call histories, SMS records, and even WhatsApp call logs for any phone number. To unlock this supposed feature, users are asked to pay — but all they get in return is randomly generated data. ESET’s investigation identified 28 such fraudulent apps, cumulatively downloaded more than 7.3 million times. As an App Defense Alliance partner, we reported our findings to Google, which removed all of the apps identified in this report from Google Play.

The CallPhantom apps mainly targeted Android users in India. Many of the apps came with India’s +91 country code preselected, and support UPI, a payment system used primarily in India. 53.7% of all CallPhantom detections worldwide were found in India.

In November 2025, we came across a Reddit post discussing an app named Call History of Any Number, found on Google Play. Unsurprisingly, our analysis showed that the ‘call history’ data provided by this app is entirely fabricated — the app generates random phone numbers and matches them with fixed names, call times, and call durations, which were embedded directly in the code, says ESET researcher Lukáš Štefanko, who uncovered the CallPhantom fraud.

In general, CallPhantom apps have a simple user interface and do not request any intrusive or sensitive permissions — they don’t need to. Coincidentally, they do not contain any functionality capable of retrieving actual call, SMS, or WhatsApp data.

In the CallPhantom apps ESET analyzed, researchers saw three different payment methods used, two of which are in violation of Google Play’s payments policy. Some of the apps relied on subscriptions via Google Play’s official billing system. Others relied on payments via a third party; in some cases, payment card checkout forms were included directly in the CallPhantom apps.

The fees requested for the fake service differ widely across the apps. The apps also appear to offer different subscription packages, such as weekly, monthly, or yearly services, with the highest requested price sitting at US$80. For the lowest “subscription tier,” the average requested price was €5.

In general, subscriptions purchased through the official Google Play billing system can be canceled. For the 28 apps described in this blog post, existing subscriptions were canceled when the apps were removed from Google Play. In some cases, refunds for Google Play purchases are possible.

If the purchase was made outside of Google Play — for example, by entering payment card details inside the app or by paying via third-party services — then Google cannot cancel the subscription or issue a refund, and users have to contact their payment provider.

For more details about CallPhantom, check out the latest ESET Research blog post, “Fake call logs, real payments: How CallPhantom tricks Android users,” on WeLiveSecurity.com. Make sure to follow ESET Research on BlueSky, and Mastodon for the latest news from ESET Research.

Govt Launches Helpline Number for Cyber Frauds, Can Also Complain for Digital Payments

With increasing Cyber ​​frauds, every passing day more and more online frauds are being reported. While some are falling prey to UPI fraud and some are being duped through social media. To prevent cyber frauds, the government has long ago launched a platform called Cyber ​​Dost, which is active on Twitter too and now in addition to this, the Union Home Ministry has launched a national helpline 155260 to prevent financial loss due to cyber frauds. 

 A statement issued by the ministry said that the national helpline and reporting platform provide a platform to the victims of cyber frauds to report such cases so as to prevent the loss of their blood and sweat earnings.

Emphasizing the commitment of the Modi government to provide a secure digital payment system, the statement said that the Ministry of Home Affairs under the leadership of Union Home Minister Amit Shah has launched a national helpline 155260 and reporting platform to prevent financial loss due to cyber frauds. is of. The respective helpline was launched on 1 April 2021 in a limited manner.

Helpline 155260 under the Ministry of Home Affairs and its reporting platform has been operated by Indian Cyber ​​Crime Coordination (I4C) with active support from Reserve Bank of India, all major banks, payments banks, wallets and online merchants. Financial Citizen Financial Cyber ​​Fraud Information and Management System has been developed institutionally by I4C to integrate law enforcement agencies, banks and intermediaries.

It is currently being carried out by seven states and union territories (Chhattisgarh, Delhi, Madhya Pradesh, Rajasthan, Telangana, Uttarakhand and Uttar Pradesh) with 55260, which cover more than 35 percent of the country's population. The work is going on to implement it all over India to curb the cheating of the public by those involved in the fraudulent acts. The helpline 155260 has helped prevent fraudulent amounts of Rs 1.85 crore from falling into the hands of fraudsters, within a short span of two months after being launched on a limited scale, the statement said.

All major public and private banks are connected to the helpline and reporting platform including State Bank of India, Punjab National Bank, Bank of Baroda, Bank of India, Union Bank, HDFC Bank, ICICI Bank, Yes Bank and Kotak Mahindra Bank etc. Payment and wallet platforms such as Paytm, PhonePe, Mobikwik, Flipkart and Amazon are also included.