Can a Single Missed Call Hack Your Phone? The Viral Warning Is False — but the Scam Hiding Behind It Is Real
It arrives as a wall of capital letters and exclamation marks, usually from a relative or an old school friend, always marked with the same desperate instruction: FORWARD TO AS MANY PEOPLE AS YOU CAN.
“Very Very Urgent,” it begins. “Please pass this message to your family and friends NOW. People have been receiving calls from Tel: +375602605281, Tel: +37127913091, Tel: +37178565072, Tel: +56322553736, Tel: +37052529259, Tel: +255901130460 or any number starting from +371 +375 +381. These guys only ring once and hang up.”
Then comes the part that makes your stomach drop: “If you call back, they can copy your contact list in 3 sec and if you have a bank or credit card details on your phone, they can copy that too… Also, Don’t Press #90 or #09 on your Mobile when asked by any caller. It’s a new trick which is use to access your SIM card, make calls at your expense and frame you as a criminal.”
Read at full speed, in a panic, the message describes a nightmare scenario: a single missed call — or worse, a single returned call — and everything on your phone, your contacts, your banking credentials, your identity, is gone. Copied in three seconds. The warning has circulated on WhatsApp, Facebook, and neighborhood group chats in dozens of countries for years, flaring up again whenever an unfamiliar international number lights up someone’s screen.
It sounds terrifying. It is also, in almost every particular, wrong. No hacker can clone your phone or vacuum up your contacts simply because you answered a call, missed a call, or called a strange number back. That is not how phones work. But buried inside the hoax is a genuine threat that has cost people real money on every continent — a threat the hoax itself misunderstands. This is the story of the fake warning, the real scam it accidentally points at, and the one extraordinary case in which a missed call truly did hack phones.
The anatomy of the hoax
The viral warning is a classic chain message, and it has a recognizable skeleton. It names specific phone numbers. It lists country codes — +375 for Belarus, +371 for Latvia, +381 for Serbia, +370 for Lithuania, +255 for Tanzania, +563 for a region of Chile — and explains that these are the codes the “hackers” use. It describes a precise, impossible technical mechanism: calling back lets the criminals “copy your contact list in 3 sec” and extract “bank or credit card details on your phone.” It adds a secondary warning about pressing #90 or #09 when asked by a caller, supposedly a trick to hijack your SIM card. And it ends with the fuel that powers every chain message: “URGENTLY FORWARD this message to as many friends as you can.”
Fact-checkers who have chased this message down are emphatic about one detail: it is old. The Malaysian technology site TechARP, which has debunked the message repeatedly, notes that it “has been circulating on WhatsApp and social media platforms since April 2020, if not earlier” — calling it “yet another example of FAKE NEWS.” Versions of the same warning, with the same phone numbers, were already doing the rounds in 2020, then faded, then came roaring back in later years whenever a wave of genuine spam calls gave people a reason to be nervous.
Every element of the technical story collapses under scrutiny. A phone call — answered, missed, or returned — is a voice connection routed through your carrier’s network. It carries audio. It does not carry a channel that lets a stranger reach into your phone and download your address book, and there is no mechanism by which pressing a few digits on your keypad mid-call can transfer control of your SIM card to a criminal. As security writers have repeatedly explained, answering a call cannot by itself plant malware, grant camera access, or share your contacts; a call is simply not that kind of connection.
So why does the warning feel so plausible? Because it is built on the scaffolding of a real crime. The numbers it names, the “rings once and hangs up” pattern, the international country codes — those are all features of a genuine, well-documented fraud. The hoax simply grafts a science-fiction payload onto it. The real version of the scam cannot clone your phone. It can, however, empty your wallet.
Wangiri: the real scam hiding inside the hoax
The genuine crime has a name, and it comes from Japan: Wangiri, which fraud investigators translate as “one ring and cut.” That is exactly what it is. A robocall system fires off calls from premium-rate or international numbers to long lists of targets — sometimes millions at once — lets each one ring a single time, and hangs up before anyone can answer. The missed call sitting in your notifications is the bait. The scam only moves forward if you call the number back.
If you do, you are connected to a premium-rate number, often in another country, and the meter starts running the moment the call connects. The operators then work to keep you on the line as long as possible — hold music, recorded messages, automated voices that keep you waiting. In the United States, AT&T’s consumer-security team describes the playbook in detail: the callbacks play recorded messages designed to keep you talking, such as a voice stammering “Hello… hello? I’m having trouble hearing you. Hello?… Will you please call back?” — each callback generating more charges. One newer trick tells victims they have “received a song from someone who loves you” and must keep listening to learn who sent it. The longer you stay on the call, the more you pay — and the scammer collects all or part of those fees.
The mechanics are cheap for the criminals and brutally effective because they weaponize ordinary human impulses: curiosity about the mystery caller, politeness that says return every call, fear of missing something important. The single ring is deliberate. An unanswered missed call gnaws at you far more than a spam call you picked up and hung up on.
Authorities have been warning about it for years. The U.S. Federal Communications Commission issued a consumer alert in May 2019 after receiving about 2,600 complaints about one-ring scams, noting the calls were arriving in bursts, often in the middle of the night, frequently from the “222” and “232” country codes of Mauritania and Sierra Leone. The FCC’s advice was blunt and has not changed since: “do not call back numbers you do not recognize, especially those appearing to originate overseas,” check your bill for unfamiliar charges, and consider asking your phone company to block outbound international calls if you never make any. The U.S. Federal Trade Commission reinforced the message in a July 2022 consumer alert: “Get a one-ring call? Don’t call back.” Congress even wrote the scam into law — the Pallone-Thune TRACED Act, signed on December 30, 2019, ordered the FCC to start proceedings specifically to protect consumers from one-ring fraud.
The scam is far from an American problem. Kenya’s Communications Authority, through its National KE-CIRT/CC incident-response team, has warned about repeated resurgences of the Wangiri fraud targeting Kenyans — first flagged back in 2018 after an alert from telecom operator Safaricom, and making comebacks ever since. Recent victims received the single-ring calls from illegally purchased numbers using prefixes from Peru (+51) and New Zealand (+64). The authority warned that prepaid subscribers can lose their entire loaded airtime while postpaid users discover the damage only when their monthly bill arrives. Malaysian carrier CelcomDigi and the UK’s Virgin Media have published near-identical warnings: don’t call back, Google the country code first, and remember the call is not personal — your number is just one entry on a very long automated list.
How much money does the scam siphon off? Security analysts cited in recent coverage estimate that Wangiri fraud generates billions of dollars in losses globally every year. Even if the exact figure is debatable, the pattern is not: a fraud that costs almost nothing to run, at machine scale, against the universal human itch to return a missed call.
Notice what the real scam does not do. It does not install malware. It does not copy your contacts, read your banking app, or clone your phone. It simply bills you for a very expensive phone call. That is expensive enough — but it is a billing fraud, not a device hack. The viral warning took the real pattern (one ring, hang up, strange country code) and invented a completely different, technically impossible payload (instant phone cloning).
Why a missed call can’t empty your phone
To understand why the hoax is impossible, it helps to understand what a phone call actually is. When someone dials your number, the call is set up through your carrier’s signaling network and connected as an audio channel between two devices. No file transfer occurs. No code runs on your phone. No data access is granted. Your phone treats the call as what it is: a request to open a voice conversation.
Answering the call changes nothing about that architecture. It does not hand the caller your camera roll, your contacts, your messages, or your banking details. Pressing digits like #90 or #09 during a call sends touch tones down the audio channel — the same beeps your phone plays when you navigate an automated menu. They cannot seize control of your SIM card or “make calls at your expense.”
Real mobile attacks look nothing like the chain message describes. The attacks that actually succeed tend to fall into three categories, and none of them involves a magic missed call:
Social engineering — the human, not the handset. The genuinely dangerous version of a phone-based attack is the conversation itself. Scammers pose as your bank, a courier, a government agency, or tech support and pressure you into handing over passwords, one-time codes, or payment details. No software is installed; you are persuaded. This family of attacks — “vishing” (voice phishing) and “smishing” (SMS phishing) — accounts for the overwhelming majority of successful phone fraud.
Malware that needs your cooperation. For a criminal to get spyware onto an ordinary person’s phone, they generally need the victim to do something: tap a malicious link, install a sketchy app, or grant intrusive permissions. A text message can carry a dangerous link — but the text itself doesn’t execute code; the tap does. This is why security experts repeat the same advice: don’t click links in unexpected messages, don’t install apps from outside the official stores, and keep your operating system updated so known vulnerabilities are closed.
Account takeover, not device takeover. SIM-swapping attacks let criminals convince a carrier to move your number to their SIM, intercepting your calls and two-factor codes — a serious threat, but it targets your carrier account, not your handset, and it starts with stolen personal data, not a missed call.
The honest bottom line, echoed by security researchers across the industry: the risk of having your phone completely compromised by an incoming call is, for an ordinary person, essentially zero. The calls are dangerous because of what they persuade you to do, not because of what they do to your device.
The one time a missed call really did hack phones
There is exactly one historical episode that gives the hoax its grain of truth — and it looks nothing like the viral warning. In May 2019, WhatsApp disclosed that hackers working for a “state actor” had been planting military-grade spyware on phones through missed WhatsApp voice calls. The spyware was Pegasus, built by the Israeli surveillance vendor NSO Group. The exploit, tracked as CVE-2019-3568, was a buffer-overflow flaw in WhatsApp’s voice-calling stack: a specially crafted data packet delivered during an incoming call could execute code on the target’s phone even if the victim never answered. The target would simply see a missed call — and be infected.
This was real, and it was frightening. But every detail of it is the opposite of the chain message’s scenario. First, it was not a regular phone call — it was a call inside the WhatsApp app, exploiting a specific software bug in that app. Second, the targets were not random: WhatsApp later said the vulnerability was used in targeted attacks against roughly 1,400 people — journalists, human rights defenders, political dissidents, and diplomats. Third, it was fixed: WhatsApp patched the flaw in May 2019 and pushed urgent updates, and the company has confirmed that everyone who updated was protected from that particular vulnerability ever since. Fourth, the tool itself was not something a scammer could buy — Pegasus is sold by NSO Group to government clients, and the U.S. federal courts later held the company accountable: a jury ordered NSO Group to pay WhatsApp $167,254,000 in punitive damages, plus $444,719 in compensatory damages, for the 2019 campaign.
The 2019 WhatsApp case proves that a “missed call hack” is not physically impossible in every universe — it is just not something that happens to ordinary people through ordinary phone calls, and it has nothing to do with the cloned-contacts-in-three-seconds story in the viral forward. Conflating the two is like hearing that a bank vault was cracked by a professional crew with inside knowledge and concluding that your bicycle lock can be picked by someone glancing at it.
It is also worth noting that the hoax’s secondary claim — the #90/#09 keypad trick — has been circulating almost as long as mobile phones themselves and has never had a shred of evidence behind it. Touch tones cannot hijack a SIM.
What to actually do when the phone rings once
The irony of the viral warning is that its advice is half-right for the wrong reasons. You should indeed be cautious about one-ring calls from unknown numbers — just not because they’ll clone your phone. Here’s what the regulators and carriers actually recommend:
Don’t call back unknown numbers, especially international ones. This is the single most important rule, repeated by the FCC, the FTC, and carriers on multiple continents. If you see a missed call from a number you don’t recognize — particularly one starting with a “+” or an unfamiliar country code — resist the curiosity. As AT&T’s security team advises, watch for the “+” sign ahead of the area code when a callback starts connecting: it signals an international call, and you should hang up immediately.
Check before you dial. If you’re genuinely unsure whether the call was legitimate, look up the country code with a quick web search. Not expecting a call from Mauritania, Sierra Leone, Belarus, or Latvia? Then you have your answer. A legitimate caller with something important to say will leave a voicemail or reach you another way.
Never share codes or credentials with a caller. Real banks, real tech companies, and real government agencies don’t call you out of the blue and ask for your password or the one-time code that just arrived by text. Urgency and secrecy are the two hallmarks of a voice-phishing attempt.
Block, report, and check your bill. Use your phone’s built-in spam blocking and your carrier’s call-protection tools. If you accidentally called back a suspicious number, check your phone bill for charges you don’t recognize and dispute them with your carrier — then file a complaint with your national regulator. If you never make international calls, ask your carrier about blocking outbound international dialing entirely.
Keep your apps and operating system updated. The one genuine missed-call attack in history worked through an unpatched software bug. Updates are how those bugs die.
The Verdict
False. The claim that a missed call — or a returned call, or pressing #90 on your keypad — lets hackers clone your phone, copy your contact list in seconds, or steal your banking details is false. It has been circulating since at least April 2020, and it describes capabilities that phone calls simply do not have.
What is real is the crime the hoax is loosely based on: Wangiri, the “one ring and cut” scam, in which criminals use auto-dialers to leave missed calls from premium-rate international numbers, hoping you will call back and run up per-minute toll charges that flow to them. That fraud is documented by the FCC, the FTC, and telecom regulators in multiple countries — and its defense is simple: don’t call back numbers you don’t recognize.
There is one genuine exception in history — the 2019 WhatsApp zero-click vulnerability exploited by NSO Group’s Pegasus spyware, which could infect a target through a missed WhatsApp call. It affected about 1,400 specifically targeted individuals, was patched by WhatsApp in May 2019, and has no connection to ordinary phone calls or to the viral warning’s claims.
So the next time the chain message lands in your family group chat, you can reply with confidence: no, the missed call cannot hack your phone. But while you’re at it, do everyone a favor and add the real warning — the one the hoax forgot. Don’t call the number back. That part, at least, would actually save someone money.
