Privacy risk from apps used for filtering spam calls

Ayra Wang

Hongkongers are urged to pay attention to spam call-blocker applications that can access their contact lists, as the Consumer Council found two apps would make users' information accessible to others simply by searching.

The consumer watchdog reviewed five junk call-blocker apps widely used in Hong Kong - CallApp, Call Defender, Jima Caller ID, Truecaller and Whoscall - between February and April and found that the Android version of CallApp, Truecaller and Whoscall would require access to users' contact lists.

Kenneth Chan Kin-nin, vice-chairman of the council's publicity and community relations committee, said yesterday that its tests found that CallApp will automatically upload and integrate all information from a user's contact list into its database if users permit access, enabling other users to freely access through a "reverse lookup" function.

Chan said the function allows users to trace the personal information of mobile number holders, including names, email addresses and social media links, by simply entering the phone number.

"If a user had stored the mobile numbers of friends and relatives in their contact list and permitted access when using the app, personal data of these friends and relatives would also be accessed and uploaded by the app even if they had never downloaded the app or authorized such use," he explained.

Truecaller can access and upload users' contact lists in a similar manner but only when the user downloads the app from its official website and enables the "enhanced search functionality."

During a trial test, the council also found that the two apps list sensitive information, such as former residential addresses that include floor and flat numbers and monthly rent, alongside the names of number holders.

"This has raised suspicions that such data was obtained from the contact lists of the number holders' landlords or real estate agents," Chan said, adding that such use of data is "unfair and hard to guard against."

CallApp was found to retain users' data for a maximum of five years even after the user had requested to delete it, and according to its privacy policy, the data could still be stored in its backup system after the retention period.

The council's chief executive, Gilly Wong Fung-han, urged people to think twice before using such apps.

"Citizens are advised to carefully learn about the privacy policy of the app, especially whether it will require access to contact lists," Wong said.

She said access to personal contact lists is not a must for call-blocking apps, and Hongkongers should fully understand their features and terms before choosing one.

People should also pay attention to subscriptions, as most of the apps will automatically renew plans by default, and removing the app from the user's phone does not necessarily cancel a paid subscription.

ayra.wang@singtaonewscorp.com