The AfterCall Fraud Explained
You hang up. A full-screen ad explodes onto your screen. You didn't open anything. You didn't tap anything. It happens after every call — and no amount of settings-digging or "cleaner" apps makes it stop. Security researchers named this exact pattern in 2026: AfterCall.
"You're not imagining things — and you're far from alone."
Happens After Every Call
Full-screen ads appear immediately after you hang up — every single time.
No Obvious Cause
Nothing shows up in recent apps, settings, or standard security scans.
You're Not Alone
Millions of users are affected — researchers gave it an official name in 2026.
A Genuinely Widespread, Newly Identified Problem
Who Found It?
Researchers at DoubleVerify's Fraud Lab, along with separate reporting from Malwarebytes, identified a coordinated wave of Android apps in July 2026 — built specifically to fire ads the moment a phone call ends, outside any app the user intentionally opened.
How Do They Hide?
The apps disguise themselves as everyday utilities — alarm clocks, calendars, messaging tools — things people install without much scrutiny because the purpose seems obvious and low-risk.
How a Simple Utility App Hijacks Your Screen
Permission Granted
The app redirects you to your phone's Settings menu and convinces you to enable "Display over other apps," framing it as necessary for a legitimate-sounding feature. Once approved, the door is open.
Waiting in the Dark
A broadcast receiver runs silently in the background, listening for one specific system event — the exact moment a phone call ends. It triggers instantly, with no action required from the user.
Fake Call Summary
A full-screen ad appears, disguised as a real call summary screen — complete with a caller name and photo — designed to look like a built-in phone feature. The app then immediately removes itself from your recent apps list to avoid detection.
Why This Is Genuinely Difficult to Diagnose Yourself
AfterCall was designed to resist casual troubleshooting. The apps hide in plain sight — disguised as clocks, notepads, and calendars. And because the ad appears completely separate from the app causing it, even a careful user checking their recent apps is unlikely to make the connection.
Disguised Icons
Apps look like clocks, notepads, or calendars — nothing suspicious at first glance.
No App Trail
The ad appears separate from the app causing it, so checking recent apps won't help you find the culprit.
Constantly Evolving
Dozens of new variations appear on the Google Play Store every month, making it an organised, ongoing fraud operation.
How to Find and Remove the Culprit
Here is exactly what to do, step by step:
Check your "Display over other apps" permission
Go to Settings → Apps → find "Display over other apps" or "Appear on top" and review every app that has been granted it.
Be suspicious of simple utility apps
Alarm clocks, flashlight tools, and calendar apps rarely have a legitimate reason to display content over your entire screen — treat that permission as a red flag.
Revoke permissions one at a time
Remove "Display over other apps" from any app you don't fully recognise or trust, one at a time, and check whether the after-call ads stop.
Uninstall recently added utility apps
If ads persist, uninstall recently added utility apps — start with the ones you use least or installed most recently.
Be careful with "cleaner" or "antivirus" apps
Don't download a new cleaner or antivirus app to fix the problem without first checking its reviews and permissions — some marketed as a fix are part of the same fraudulent ecosystem.
A Broader Lesson About Everyday App Permissions
This entire fraud scheme depends on one thing: users granting a sensitive permission without pausing to ask why a simple alarm clock or calendar app would need it in the first place.
One Question Stops It
Actually reading what a permission request is for before tapping through is one of the most effective and completely free defences against this and many similar categories of mobile app abuse.
Seconds, Not Minutes
It costs nothing and takes only a few extra seconds during setup — yet it's precisely the step most people skip entirely.
Help Those Around You
If you manage devices for family members less comfortable with phone settings, a quick permissions review together can make a real difference. This scheme has proven especially persistent for users less likely to investigate an unusual pop-up on their own.
Why Advertisers and Users Both Lose
Who Profits?
Every time an AfterCall ad appears and gets viewed or accidentally tapped, the app's developer earns a small advertising payout, funded by real advertisers who believe they are paying to reach genuinely interested users through legitimate placements.
What Actually Happens?
Instead, that advertising budget is being spent on forced, unwanted impressions shown to frustrated people who never chose to see them and often cannot even identify which app is responsible. Industry researchers tracking this space describe it as a quiet tax on the entire mobile advertising ecosystem, one that ultimately raises costs for legitimate advertisers while providing no genuine value to the people being shown the ads.
New Variants Monthly
New disguised app variations continue to appear on Google Play each month despite platform-level enforcement.
Ad Budget Wasted
Advertising budgets are spent on forced, unwanted impressions that deliver no genuine value to users or advertisers.
To Stop It
A quick check of your app permissions is usually all it takes to shut down the scheme for good.
Stay Informed. Stay Protected.
Your Simple Take-Away
Here is what every Australian needs to remember:
Ads after calls = AfterCall fraud
If you see a full-screen ad every time you hang up, a sneaky app is almost certainly to blame — not your phone, not your carrier.
Check "Display over other apps"
Go to Settings → Apps → look for "Display over other apps." Revoke that permission from any app you don't fully trust.
Always ask "why does this app need that?"
A clock or calendar app has no good reason to display content over your whole screen. If a permission request seems odd, trust your gut and say no.
Help your family too
Do a quick permissions check with older relatives or anyone less confident with tech — this scheme targets people who are less likely to investigate a strange pop-up.
Glossary: Plain-English Explanations
Not sure what some of these tech terms mean? Here's a quick guide in plain English.
DoubleVerify & Malwarebytes
These are cybersecurity research companies. DoubleVerify focuses on digital advertising fraud, and Malwarebytes specialises in detecting malicious software. Both helped identify and expose the AfterCall fraud scheme in 2026.
Permission
A permission is your phone asking, "Is it okay if this app does this?" — for example, accessing your camera, microphone, or displaying content over other apps. You can always say no, or take it back later in Settings.
Display over other apps (SYSTEM_ALERT_WINDOW)
A special Android permission that lets an app put content on top of everything else on your screen — even when you're using a different app. Legitimate apps rarely need this. If a simple utility asks for it, be suspicious.
Broadcast Receiver
A piece of hidden code inside an app that listens for specific events on your phone — like a call ending — and then does something automatically, such as showing an ad. You can't see it running; it works silently in the background.
Utility App
A simple, everyday app designed to do one small job — like a torch (flashlight), alarm clock, calendar, or notepad. These are often trusted without much thought, which is exactly why fraudsters disguise their apps as utilities.
Ad Impression
Every time an advertisement is shown to someone — whether they wanted to see it or not — that counts as one "impression." Fraudsters earn money for each impression, which is why they want to show you as many ads as possible.
Fraudulent Ecosystem
A network of apps, developers, and ad systems all working together dishonestly to make money — often at the expense of everyday users and legitimate businesses.
Google Play Store
The official app store for Android phones. While Google has rules against harmful apps, some slip through before being caught and removed — which is why checking permissions yourself still matters.
AfterCall
The name security researchers gave in 2026 to a specific type of fraud where sneaky apps show you full-screen ads the moment you hang up a phone call.
Why Does Every Call End in Ads?