28 fraudulent apps not only bypassed detection on the official app platform — they even charged subscriptions for a fake illegal service.
More apps on the official Google online store for Android apps have been found to be fraudulent yet allowed to appear on the trusted catalog.
This time, the scam apps involved have been offering to provide the call history “for any number” supplied by users after a paid subscription: detailed logs, including call histories, SMS records, and even WhatsApp activity.
In reality, the data delivered after payment was entirely fake, consisting of randomly generated phone numbers paired with prewritten names, timestamps, and call durations embedded within the app code. Users were charged for access to these features through various payment methods, including subscriptions and direct card payments.
App fraud details
A total of 28 such apps were identified, with combined downloads exceeding 7.3m. The majority of activity was concentrated in India, accounting for 53.7% of detections. Many apps appeared tailored to that market, with India’s +91 dialing code preselected and support for local payment systems such as UPI. Other characteristics discovered were:
- The apps required minimal permissions and avoided requesting sensitive access, as they lacked any real capability to retrieve genuine telecommunications data. Their simple design and limited functionality helped them evade suspicion while still appearing legitimate to users seeking such services.
- Pricing structures varied widely. Some apps offered weekly, monthly, or annual subscription tiers, with fees ranging from about €5 for lower tiers, to as high as US$80 for premium options.
- Different payment methods were offered, with some transactions processed through official app store billing systems, while others redirected users to third-party services or in-app card entry forms — approaches that may violate platform policies.
Users who subscribed through official billing channels may be eligible for cancellations or refunds, particularly after the apps were removed from the platform. However, those who paid outside of official systems must seek reimbursement directly from their payment providers, as platform operators cannot intervene in those cases.
According to Lukáš Štefanko, Security researcher, ESET, the firm that disclosed the fraud scheme to Google Play, the apps “…generate random phone numbers and match them with fixed names, call times, and durations…” and noted that no real data retrieval occurs.
