Flash calls: Third-party aggregators save cash even as telcos red-flag new verification method

Missed calls have long been used informally as a signalling method by users. But their adoption by enterprises as an authentication tool on Android phones has got telcos worried about revenue loss. Some are warning against the prospect of fraud.

The volume of such missed calls, also called flash calls, has surged since mobile phone operators in India hiked international calling and messaging prices by 20% last year. There have been 400 million flash calls in India since then, compared with almost none before the tariff increase, an industry source told ET, adding that one app alone is said to have made 150 million such calls.

Internationally, 60 million flash calls were made in 2021, Juniper Research estimated.


Flash calls are the third way of verifying an Android phone number, after one-time passwords (OTPs) and voice calls.

Large Price Differential
Flash calls don’t work as an authentication method on iPhones since iOS security doesn’t let apps access information on calls received.

On one hand, besides the potential for fraud and misuse, telcos say they estimate a revenue loss of almost Rs 200 crore annually since missed calls do not incur a termination charge. One the other hand, for aggregators, which act as the middle layer between enterprises and carriers, flash calls mean savings for that very reason.

“There is a large price arbitrage in domestic and international SMS/call rates in India, which prompts foreign businesses to explore alternative authentication mediums,” said Rajdipkumar Gupta, chief executive of cloud communications company Route Mobile. “Currently, operators charge $0.04 (or Rs 4.13) for international OTP messages or an authentication call, which (also) require manual input such as entering the (number). But a simple missed call does away with… that cost.” The company has witnessed a surge in flash calls lately, he said.

Modus Operandi
When an app requires verification, the process starts with a third party initiating a call that lasts a few seconds. At the same time, a code using digits from the caller’s number is generated. The app seeking authentication then uses an application programming interface (API) to read the last call from the recipient’s log and automatically picks up the code that was created, thus facilitating the verification. There is no manual input required by the receiver; the app deciphers the code by itself.

French telecom operator Orange has flagged the trend in a blog, saying flash calls use up network resources without giving any returns. In fact, the rate at which their usage is predicted to grow, telcos may need to make additional investments in networks to maintain quality of service.

Flash calls also increase the probability of fraud as the mobile phone user is not aware of activity by the number, experts said.

“The Reserve Bank of India enforces extreme trust in SMS as a medium for multi-factor authentication, and lawfully prohibits banks to use any other method, which means that banking transactions cannot be approved over flash calls,” said Aniketh Jain, cofounder of customer communications startup Fyno. “But the larger worry is the social engineering it could do, accessing your social media accounts or online wallets, for instance, or even changing passwords of your banking applications and taking control.”

The Telecom Regulatory Authority of India didn't respond to queries. A senior official said the authority was yet to study the issue in detail.

Route’s Gupta said operators can either monetise flash calls by setting a competitive price, or block them by deploying cutting-edge voice firewalls using machine learning algorithms and pattern-mining tools that analyse signalling traffic real-time.