This dangerous 'CallPhantom' scam spread to 28 Google Play apps downloaded more than 7 million times - here's what we know

ESET discovered 28 fraudulent apps on Google Play, downloaded them more than 7.3 million times and falsely claimed to reveal call/SMS/WhatsApp history
The apps generated fake data and charged subscriptions between $6 and $80, with most victims located in India.
Google removed apps and refunded Play-based payments, but victims of third-party payments must request refund directly

Google has removed more than two dozen Android apps from the Play Store for promising users something it can’t deliver and charging a good amount of money for it.

ESET security researchers found 28 apps in Google’s Android repository that claimed to provide call history for virtually any number. These apps also claimed that they could recover people’s SMS and WhatsApp call logs.

But the “service” is not free: users were asked to purchase different subscription packages, ranging from weekly to annual, and costing between $6 and $80.

ghost call

In total, the apps were downloaded more than 7.3 million times, ESET said. The worst thing is that they did not and could not provide the service they advertised:

“In November 2025, we came across a Reddit post that talked about an app called Call History from Any Number, found on Google Play,” ESET explained. “As expected, our analysis showed that the ‘call history’ data provided by this app is completely fabricated: the app generates random phone numbers and matches them to fixed names, call times and durations, which were embedded directly into the code.”

ESET named the campaign CallPhantom.

Most of the victims are in India. Many of the apps came with India’s +91 country code preselected and supported UPI, which is a payment system primarily used in that country. ESET said the majority (53.7%) of all CallPhantom detections worldwide were found in India.

Victims were offered three ways to pay for the service. One is through the official Google Play billing system, while the other two relied on third parties. Subscriptions made through Google Play can be canceled (and were canceled for all apps that were removed from the repository) and victims can receive a refund.

For the other two methods, users are recommended to contact their payment provider for options.