ESET Research uncovers CallPhantom scam on Google Play
A new Android scam, CallPhantom, falsely claims to provide access to call logs, SMS records, and WhatsApp call history for any phone number in exchange for payment.
ESET identified and reported 28 separate CallPhantom apps on Google Play, cumulatively downloaded more than 7.3 million times.
Some CallPhantom apps sidestep Google Play’s official billing system, complicating victims’ refund efforts.
ESET researchers have uncovered fraudulent apps on Google Play that claim to provide the call history “for any number.” The offending apps, which ESET named CallPhantom based on their false claims, purport to provide access to call histories, SMS records, and even WhatsApp call logs for any phone number. To unlock this supposed feature, users are asked to pay — but all they get in return is randomly generated data. ESET’s investigation identified 28 such fraudulent apps, cumulatively downloaded more than 7.3 million times. As an App Defense Alliance partner, ESET reported their findings to Google, which removed all of the apps identified in this report from Google Play.
The CallPhantom apps mainly targeted Android users in India and the broader Asia Pacific region. Many of the apps came with India’s +91 country code preselected, and support UPI, a payment system used primarily in India.
In general, CallPhantom apps have a simple user interface and do not request any intrusive or sensitive permissions — they don’t need to. Coincidentally, they do not contain any functionality capable of retrieving actual call, SMS, or WhatsApp data.
In the CallPhantom apps ESET analyzed, researchers saw three different payment methods used, two of which are in violation of Google Play’s payments policy. Some of the apps relied on subscriptions via Google Play’s official billing system. Others relied on payments via a third party; in some cases, payment card checkout forms were included directly in the CallPhantom apps.
The fees requested for the fake service differ widely across the apps. The apps also appear to offer different subscription packages, such as weekly, monthly, or yearly services, with the highest requested price sitting at US$80. For the lowest “subscription tier,” the average requested price was €5.
In general, subscriptions purchased through the official Google Play billing system can be canceled. For the 28 apps described in this blog post, existing subscriptions were canceled when the apps were removed from Google Play. In some cases, refunds for Google Play purchases are possible.
If the purchase was made outside of Google Play — for example, by entering payment card details inside the app or by paying via third-party services — then Google cannot cancel the subscription or issue a refund, and users have to contact their payment provider.
For a more details about CallPhantom, check out the latest ESET Research blog post, “Fake call logs, real payments: How CallPhantom tricks Android users,” on WeLiveSecurity.com.
May 21, 2026 at 1:27 pm
“ESET’s discovery of 28 CallPhantom apps accumulating over 7.3 million downloads is a sobering reminder that the app store model — while improved — still has meaningful gaps when it comes to pre-publication vetting of fraudulent functionality. The fact that these apps required no sensitive permissions is actually what makes them so instructive: the threat wasn’t technical exploitation, it was pure deception dressed up in a legitimate-looking package.
What’s particularly concerning from a security and compliance standpoint is that several of these apps deliberately bypassed Google Play’s official billing system. That’s not an accident — it’s a calculated move to eliminate the consumer protection layer that would otherwise enable refunds and subscription cancellations, effectively trapping victims with no recourse through normal channels.
For organizations thinking about mobile security policy, CallPhantom should be a case study in why app governance needs to extend beyond permission-based risk models. The next generation of scams won’t ask for your camera or contacts — they’ll just ask for your credit card, and they’ll do it inside an app that looks completely benign. Security controls and employee awareness programs need to evolve to catch that.”
— Justin Beals, CEO & Founder, Strike Graph