New Delhi: If you are a mobile phone user in India, you are no stranger to spam calls. From an irritant call from a marketer selling a house or insurance, to potentially harmful ones from scammers out to dupe you — there is no escape.
The scale of spam calls in India is staggering. According to a 2021 report by caller identification application Truecaller, an Indian mobile phone user on average gets about 17 spam calls in a day. The report added that India moved up to the fourth spot in 2021 — from ninth in 2020 — in the list of countries affected by spam.
Even as the Telecom Regulatory Authority of India (TRAI) is reportedly working on finding a solution to the spam call problem, spammers and scammers have begun to exploit popular instant messaging applications such as WhatsApp and Telegram.
“I’m constantly bombarded with spam calls and messages, despite having registered for the Do Not Disturb (DND) service,” said Stuti Roy, a communications professional with a multinational company. “It is frustrating. I am also flooded with spam messages and missed calls on my WhatsApp from international numbers.”
DND is an initiative by TRAI that allows individuals to opt out of receiving unsolicited telemarketing calls and messages.
Another mobile phone user, Amit Negi, an electrical designer based in Delhi, recounted two separate incidents where he received missed video calls on WhatsApp from an international number, and a suspicious message that he said “was clearly a scam”. The message, sent from another international number, read, “Hello dear, how are you today,” accompanied by a smiling face emoji and a heart.
Another smartphone user, requesting anonymity, said she received an unexpected call on Telegram from an unknown person at 7 am, which she unintentionally missed. The call, she later found out, was accompanied by a message and a “highly inappropriate and sexually explicit GIF”.
Replying to a query from ThePrint, Telegram spokesperson Remi Vaughn said that users of the app can control who is able to call them. This, Vaughn added, can be done through the Settings > Privacy and Security > Calls menu.
“Because Telegram calls are end-to-end encrypted, it’s not possible for anyone but the participants to know what happens. However, Telegram uses a combination of automated tools and user reports to combat spam on our platform,” he added.
In an emailed response to queries, a WhatsApp spokesperson said, “Over the years, we have consistently invested in Artificial Intelligence and other state-of-the-art technology, data scientists and experts, and processes, in order to keep our users safe on our platform.”
“Being end-to-end encrypted, WhatsApp has no visibility into the content of messages between a sender and receiver. Hence, we rely on behavioural signals from accounts and available unencrypted information, including user reports, profile photos, group photos and descriptions,” the spokesperson said, adding that the platform applies spam detection technology to spot and take action against accounts engaging in abnormal behaviour.
On its FAQ page, WhatsApp warns that “users may receive messages on any app with details of a windfall gain, job offer, quick money scheme, among others”.
“Let your better judgement prevail and carefully scrutinise such messages as they could be scams. Block and report such senders without interacting further,” it adds.
According to a February 2023 report by Delhi-based community social network LocalCircles, 95 per cent of WhatsApp users in India surveyed claimed receiving pesky or unsolicited commercial communication every day. For the survey, LocalCircles collected 51,000 responses from citizens in 351 districts.
The report, which LocalCircles said has been shared with the Ministry of Electronics and IT as well as TRAI, noted that WhatsApp users in India indicate that most of such messages come from someone selling financial services, real estate, offering jobs/earning opportunities, healthcare and pathology services.
A lot of spammers are also using these messaging platforms to either scam people, or send unwanted/unsolicited sexually explicit messages or images.
ThePrint reached regulator TRAI and the Cellulars Operators Association of India (COAI) — which has Bharti Airtel, Vodafone Idea, and Reliance Jio as its members — for a comment via email, but did not receive a response. Queries have also been mailed to the Department of Communications but their reply is awaited.
Also read: WhatsApp blocked 47 lakh Indian accounts in March, 16 lakh of them proactively
Sudden spike
Speaking to ThePrint, Amit Jaju, Senior Managing Director at Mumbai-based advisory firm Ankura Consulting Group (India), said there “can be a multitude of factors contributing to the sudden increase in spam/fraud calls in India”.
“The increasing digital literacy and usage of smartphones has made it easier for scammers to reach a large number of people… The availability of cheap data and call plans has also facilitated this increase,” he added.
The socioeconomic effects of Covid-19 pandemic have also played a role, as many scammers are taking advantage of the situation, offering fake services or exploiting people’s economic situation, Jaju said.
Lack of stringent data privacy regulations and illegal sale of contact information, fuelled by data breaches in major companies with customer data, have also provided fraudsters with effortless access to a vast pool of potential victims, he added in his emailed response.
Innovative ways
On the ways in which people are scammed, Harish Kumar G.S., head of sales for India and SAARC at Check Point Software Technologies, a cybersecurity solutions provider, said individuals pretending to be bankers, insurance agents, government officials, and other authority figures may contact or approach clients through the phone or social media.
These impostors may use some personal information about the customer, such as their name or date of birth, to gain their trust, he said to ThePrint in his emailed response.
They may also employ various tactics — applying pressure or deception — to coerce clients into revealing sensitive information like their passwords, OTPs, PINs, and CVVs, citing “urgent” situations such as blocking an unauthorised transaction, avoiding penalties, or receiving a discount. Once they obtain these credentials, they can use them to defraud the users.
According to the Truecaller report, over 202 million (or 2,020, lakh) spam calls were made by just one spammer in India in 2021. That’s over 6,64,000 people disturbed by spam calls every day and 27,000 people every hour — from just one phone number.
“This may sound unbelievable, but it’s true…Makes you wonder how the telecom operators even allow this kind of call volume. The vast majority 93.5 per cent of all spam in India are sales or telemarketing calls,” the report said.
It stated that one of the common scams in the country remains the “ever-popular KYC (know your customer) scam”, where fraudsters pretend to be a bank or digital payment service, asking for user KYC documents as mandated by the Reserve Bank of India.
In addition, multiple user reports to Truecaller mention that the typical way scammers operate in India is to get unsuspecting victims to download a remote access app, which eventually leads to a huge loss of money from banks, cards and digital mobile wallets.
Amit Jaju added that there are also scams involving winning a lottery or prize, where the victim is asked to pay a small fee to receive their winnings. “Using AI, they can also deepfake the voice of a familiar person and easily get access to OTPs etc,” he said.
According to LocalCircles, they have received multiple user complaints reporting instances where individuals are consistently receiving missed calls on WhatsApp from international numbers.
Subsequently, when they enquire about the missed calls, they are offered job opportunities or broking services. Another type of complaint that LocalCircles has received involves ‘sextortion’. In these cases, users receive missed video calls, and if they return the call, they are confronted with a naked individual or a pornographic video of some kind. The scammer takes a screenshot of the caller in this compromising situation and later resorts to blackmail.
Jaju added that the trend of getting missed calls on platforms such as WhatsApp is part of a scam known as the “Wangiri fraud”. Scammers dial numbers internationally, ring once, and then cut the call. “The aim is to entice the recipient to call back accidentally using normal call or SMS message, at which point they can be charged exorbitant fees, or the scammer may try to extract personal information,” he said.
A lot of times the calls aren’t really from international companies but, “fraudsters often use caller ID spoofing or use virtual numbers to make it appear as though the call is coming from a different country”, he added.
Unsolicited commercial messages
Currently, there are no specific regulations in place to address the problem of unsolicited calls and messages received on platforms such as WhatsApp and Telegram.
However, the inadequate enforcement of regulations concerning unsolicited commercial messages (UCC) received through regular/traditional mediums has intensified the problem of spam for users.
TRAI has been trying to get a handle on the issue since 2008, when it first released a consultation paper on the matter.
The latest regulations, known as the Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR, 2018), were implemented in February 2019, and established a framework to control UCC by mandating registration of all commercial promoters and telemarketers on a blockchain-based Distributed Ledger Technology (DLT) platform.
It also required obtaining customer consent for receiving promotional messages at specific times and days chosen by them.
According to a government statement issued in November 2022, the TCCCPR, 2018, has had a significant impact, with approximately 2,50,000 registered principal entities — businesses or legal entities that want to send commercial messages, over 6,00,000 headers (commercial messages can be sent by only using headers or alphanumeric identities, such as VM-BANK).
“This has led to a substantial 60 per cent reduction in customer complaints against registered telemarketers (RTMs). However, complaints have been observed against unregistered telemarketers (UTMs),” the statement noted.
Better regulation or enforcement?
According to the existing regulations, telemarketing activities are permitted only after registration with TRAI and after entering into commercial agreements with telecom service providers (TSP). TSPs charge a fee from businesses for registration and also for sending commercial communications.
Recent trends indicate a concerning rise in spam calls from marketers who employ ten-digit numbers typically allocated to regular subscribers, which is in contravention to the existing regulations.
“There is a lot more increase in spam from ten-digit numbers. That is something that we have been seeing as well. If you go back a couple of years, most of the spam that people used to get was from sender IDs as we call them, but now we are also seeing a lot more that is coming from these ten-digit numbers,” Kunal Dua, vice-president of search at Truecaller, told ThePrint.
He added that, while working on the global spam report, associate research was also undertaken to see how the numbers were leaking. Dua pointed out that in India specifically, numbers are shared quite freely across mobile recharge points, courier companies, office buildings and apartment buildings — where you have to give a phone number just to enter. “We really don’t know what’s happening with these massive lists that are being created,” he said.
Dua said Truecaller, too, has recently deployed AI- and ML (machine learning)-based models that help detect spam messages based on past trends rather than just text detection. Tackling spam on WhatsApp is trickier, he said, because the company does not have access to messages — as in the SMSes received on Android phones, where users can choose to give Truecaller the permission to read messages.
“So, what we do offer today is if you get a message from an unknown number on WhatsApp, we can detect the name for you. That is also done via an opt-in feature where the user allows Truecaller to read the phone notification,” he said.
He added that the company is working on a solution to help deal with WhatsApp spam and will be announcing something very soon.
Asked if he sees all spam moving to over-the-top (OTT) messaging applications such as WhatsApp and Telegram in the future, Dua said, “Yes, we are seeing an increased trend (of spam on OTT apps but I don’t think the problem is going away on SMS or regular calling. And that is what the statistics tell us. I think we’re going to see both of them growing in the future.”
He added that India already has good regulations in place. However, enforcing the regulations is the issue. “I don’t think the regulations themselves need changing, the enforcement is where we need to look,” he said.
He also said that the use of AI and ML will be key to solving the spam problem. “That is definitely the future, and we have seen AI and ML add a lot of value already at Truecaller,” he said.
“The traditional model was that you need to rely on the community and you need to have probably x number of reports before you call somebody a spammer. Now, these models are really good at catching spam even if it’s from a brand new number. That is where the power of AI lies,” Dua added.
According to media reports, beginning 1 May 2023, telcos were to introduce AI-based spam filters in their call and SMS services following directions from TRAI. However, there is no official communication on the same. Additionally, this will not deal with the barrage of spams on OTT applications.
“There are several technical and regulatory challenges involved in stopping these spam calls. Technically, scammers often use caller-ID-spoofing techniques to disguise their identity and location, making it difficult to track them down,” Jaju said.
“Regulatory challenges include the enforcement of existing laws and regulations, such as the UCC regulation, by the TRAI. While these regulations are in place, enforcing them effectively is a significant challenge due to the sheer volume of spam calls and the use of sophisticated techniques by scammers to evade detection,” he added.
Kumar of Check Point added that user awareness is essential for prevention and protection. Users should never give out personal data, always verify phone numbers, never provide remote computer access, he said.
(Edited by Smriti Sinha)