Fake call logs, real payments: How CallPhantom tricks Android users

In the ever-evolving landscape of mobile applications, the promise of accessing call records for any phone number has captured the attention of many. However, a recent investigation has unveiled a troubling trend among Android users, particularly those in India and the Asia-Pacific region. A series of fraudulent applications, collectively dubbed CallPhantom, have surfaced on the Google Play Store, enticing users with claims of providing access to call histories, SMS records, and even WhatsApp logs for a fee. Yet, the reality is far from the promises made.

Key points of this blogpost:

• A new Android scam, CallPhantom, falsely claims to provide access to call logs, SMS records, and WhatsApp call history for any phone number in exchange for payment.
• We identified and reported 28 CallPhantom apps on Google Play, cumulatively downloaded more than 7.3 million times.
• Some CallPhantom apps sidestep Google Play’s official billing system, complicating victims’ refund efforts.

Investigation

Our inquiry began in November 2025 when a Reddit user brought attention to an app named Call History of Any Number, available on Google Play. This app, misleadingly published under the developer name Indian gov.in, claimed to retrieve call histories for any provided phone number, despite having no legitimate ties to the Indian government.

Upon closer examination, we discovered that the data presented by this app was entirely fabricated. It generated random phone numbers, paired them with fixed names, call times, and durations—all hardcoded into the app’s programming. This concocted data was then displayed to users, but only after they had made a payment.

Our investigation revealed a total of 28 such fraudulent apps, which collectively amassed over 7.3 million downloads before being reported to Google and subsequently removed from the Play Store.

Campaign overview

The CallPhantom apps primarily targeted Android users in India, often preselecting the country code +91 and utilizing UPI, a popular payment system in the region. Victims left numerous negative reviews, expressing frustration over being scammed without receiving the promised data.

While the exact methods of distribution and promotion remain unclear, it appears that the allure of accessing private information successfully exploited users’ curiosity. The presence of a few glowing, albeit fake, reviews likely contributed to the apps’ initial appeal.

CallPhantom overview

Our analysis identified two distinct clusters of these deceptive applications. The first cluster utilized hardcoded names and templates, generating random phone numbers to present as partial results. Users were then prompted to pay to access the complete, yet entirely fictitious, call history.

The second cluster requested users to provide an email address where the “retrieved” call history would supposedly be sent. However, no data generation occurred until after payment was made, effectively trapping users in a cycle of payment without delivery.

Notably, the CallPhantom apps featured simple user interfaces and did not require intrusive permissions, as they lacked any genuine functionality to retrieve real communication data. Our analysis also uncovered three different payment methods employed by these apps, two of which violated Google Play’s payment policies.

What to do if you have been scammed

If you have fallen victim to one of these fraudulent subscriptions, there are steps you can take. Subscriptions made through Google Play’s official billing system can be canceled directly within the Play Store app. Google provides a detailed guide on how to manage subscriptions effectively.

For the 28 identified CallPhantom apps, existing subscriptions have been canceled following their removal from the Play Store. Refunds for purchases made through Google Play may be possible, depending on the timing and nature of the transaction. However, if payments were made outside of Google Play, users must reach out to the payment provider or app developer for resolution.

Analyzed CallPhantom apps