Google has just pulled 28 fraudulent apps from the Play Store. In a massive scam operation called CallPhantom, security experts from ESET found that these apps promised the ability to see anyone's call history, text messages, and WhatsApp call logs just by entering their phone number.
ESET researcher Lukáš Štefanko said: "In November 2025, we came across a Reddit post discussing an app named Call History of Any Number, found on Google Play.
"Unsurprisingly, our analysis showed that the ‘call history’ data provided by this app is entirely fabricated — the app generates random phone numbers and matches them with fixed names, call times, and call durations, which were embedded directly in the code."
More than 7.3 million people downloaded these apps before they were finally removed.
The Google Play Store is the official destination to download apps for your Android device | GOOGLEHowever, no legitimate app can actually access someone else's private phone records. Mobile carriers don't share this data with third-party developers.
WhatsApp also has end-to-end encryption enabled on both calls and apps. It's similar to sending a letter in a locked box where only you and your mate have the key. Every device in an encrypted chat has its own special key that scrambles your messages, photos, and video calls as they're sent. The only way to unscramble them is with the matching key on the other end. Instagram recently removed this protection.
The scam worked by showing users fake call records. Once you opened one of these apps and entered a phone number, it displayed a convincing preview designed to look like legitimate call history data.
The catch? You had to pay to unlock the so-called “full results.”
Subscription prices ranged from around $6 (roughly £5) for weekly access to as much as $80 (nearly £60) for an annual plan.
But after paying, users were given fabricated data. Investigators found the apps generated random phone numbers and matched them with preloaded names, call times, and durations embedded within the app’s code.
Some apps also sent fake notifications designed to resemble official emails, falsely claiming that search results were ready — all in an effort to pressure you into subscribing.
Users in India were hit hardest by this scam, with 53.7% of the findings coming from the country. Many of the apps came with India's +91 country code already selected, and they supported UPI – a payment system that's very popular there.
LATEST DEVELOPMENTS
- Best VPN deals
- Popular Freely TV box returns to Amazon after weeks of being sold out online
- Traditional landlines to be turned off for another 1.69 million homes in UK
- Google is killing off free tool to check if hackers know your email
- Freely strikes deal with Roku to bring Freeview replacement to more TVs
The apps also featured review sections where scammed users warned others, but these sat alongside clusters of suspiciously glowing five-star reviews that kept the ratings looking respectable.
If you've fallen victim to one of these apps and paid through Google Play's official billing system, there's good news – your subscription has been cancelled automatically, and you may be able to get a refund through your Play Store payment settings.
Although if you've paid using a third-party app or entered your card details directly into one of these apps, you'll need to contact your bank or payment provider yourself to try and get your money back.
| PEXELS
This isn't the only fraud attempt Android users have faced recently. Hackers have found a way to bypass mobile passcodes in just 45 seconds, over a hundred security flaws were recently discovered in the Android operating system, and fraudsters have been hiding malware in your TV streaming apps.
In an attempt to combat more fraudulent activity, Google is shaking up the rules for millions of Android users, making it tougher to download apps outside of the Play Store.
How to spot a scam
Here are a few examples of how to spot when a fraudster is trying to trick you:
- Messages that pressure you to act immediately
- Unexpected alerts about account issues or security threats
- Links to download apps outside official app stores
- Poor grammar, spelling, or unusual formatting
- Requests for personal or financial information
- Sender addresses that look slightly “off” or unfamiliar
- Offers or threats that feel extreme or unrealistic