Unwanted subscriptions on your phone bill: how an app signs you up without asking
Your bill goes up by a few euros. There is a line item you do not recognise, often worded vaguely as third-party services or content subscription. You did not buy anything. This is one of the most common forms of mobile fraud and one of the least written about, largely because the parties best placed to explain it are the ones collecting the money.
Find out which app did itDirect carrier billing, and why it can be abused
Mobile operators offer a payment method that charges purchases straight to your phone bill, with no card and no account. It is called direct carrier billing, or WAP billing. The convenience comes from how you are identified. When your phone is on mobile data, the operator's network already knows which subscriber line the request came from. The billing page does not need to ask who you are: it is told, by the network itself. In the smoothest implementations that reduces a purchase to a single tap on a confirm button. A flow that requires one tap and no identity check is a flow that can be completed by something other than a human finger.
How the fraud works
The pattern is consistent across the families that do this, of which Joker is the best documented. An app, usually something innocuous like a game, a wallpaper pack, a QR reader or a battery utility, opens the operator's subscription page inside a hidden WebView, a browser window with no visible interface. It then programmatically triggers the confirmation. If the operator sends an SMS to confirm the subscription, the app reads and suppresses that message, using notification or SMS access, so you never see it. From your side nothing happens. No page opens, no dialog appears, no message arrives. The subscription is active and it renews. The amounts are chosen deliberately: small enough that most people do not investigate a bill that moved by three euros, and recurring, so the total accumulates for months.
The mobile data tell
Here is a detail that is genuinely useful and almost never mentioned. Because subscriber identification comes from the operator's network, this attack does not work over Wi-Fi. There is no carrier line to identify. So the fraudulent activity happens only when the device is on mobile data. If your charges appear in clusters that match periods when you were away from Wi-Fi, that is consistent with this attack rather than with a card compromise or an app store purchase.
Reading your own bill
Ask your operator for the itemised list of active third-party subscriptions, not just the summary total. The summary line is usually generic. The itemised list names the service provider and the activation date, and the activation date is the single most useful piece of information you can get: it tells you what you installed that week.
Why this is fully visible on the network
This matters, and it is different from every other threat we cover. With credential theft, the theft itself happens on the device, locally, and network analysis observes the aftermath: the command channel and the exfiltration. Our coverage there is real but partial, and we say so. Billing fraud is not like that. The fraudulent act is a network transaction. The HTTP requests to the operator's billing portal are not a side effect of the fraud, they are the fraud. There is no local-only phase to miss. What the engines look for includes requests to subscription aggregator and operator billing endpoints from an application with no legitimate reason to contact them; the signature of a WebView loading a billing flow with no corresponding user interaction; calls to cost-per-action affiliate tracking endpoints, which is how the operators of these campaigns get paid and which appear in the traffic alongside the billing requests; and activity that occurs exclusively on mobile data and stops on Wi-Fi. Per-flow UID attribution on Android is what makes this actionable rather than merely suspicious: the report can indicate which installed package owned the connection to the billing endpoint. That is the difference between knowing your phone did this and knowing which app did it.
What to do
Bar direct carrier billing entirely. Most operators can block this payment method on your line, on request and at no cost. The option exists in most markets, though the name varies. This is the single most effective step, and if you never intend to buy anything charged to your phone bill, there is no downside. Request the refund and the deactivation in writing, referencing the itemised list and the activation dates. Keep the technical evidence. If the operator or the service provider disputes that the subscription was never authorised, a report that names the application, the billing endpoint it contacted and the timestamps is what supports your claim. Unlike a bank dispute, this is a complaint to your operator rather than a regulated payment dispute, which usually makes it faster to resolve. The report is built to support forensic analysis; where a formal proceeding follows, admissibility is decided by the court. Then uninstall the app, once you know which one it is. Not before: uninstalling first leaves you with a charge and no explanation.