“Phone bombing”: How ‘pranking as a service’ harasses victims

‘Fast and reliable bombing service with unlimited calls and instant delivery,’ says one website that offers ‘pranking as a service’. The site can help mischievous-minded individuals send multiple automated calls to Indian phone numbers.

‘Send up to 1000 calls per hour with speed and anonymity. Perfect for pranking friends or testing systems,’ reads the FAQ section of the website that is easily searchable on Google.

Phone bombing is the practice of putting someone’s phone number on a website, choosing how many fake messages or calls they should receive, and hitting send. This silly act is advertised as “harmless entertainment” and is becoming increasingly common.

The Hindu came upon multiple websites facilitating these phone-bombing prank attacks and spoke to both the victims and abusers of this service. 

“It happened to me last year. One of my friends pranked me. They had put my number and the amount of messages on the website. I then received about 50-80 OTP messages,” 20-year-old design student Prashasti (name changed) said. 

Her phone was inundated with multiple messages in under a minute while she was in class, attending a lecture. All of them, OTPs, or one-time passwords.

Aryan (name changed), 24, stumbled upon phone bombing after being fooled by his friends, and decided to target his teacher, revealing how revenge plays a central role in using the service.

“My lecturer was teaching and he was irritating, so I did it”, he said, recalling the instance when he first used phone bombing.

The victim becomes the abuser to get back at their friends or, in some cases, just out of curiosity..

“Imagine I have to trouble you okay? I will call you from your own number. You will see your number only,” said Aryan, explaining that victims receive fake calls from their own phone number during the attack. 

The modus operandi remains the same, no matter how the prank plays out. Victims receive multiple messages or calls in the span of minutes after the abuser feeds their phone number into the website. It then generates fake messages and calls, leading to the targeted person’s phone becoming unusable for a period of time. The duration of the attack can also be pre-selected on the website.

Victims’ reactions differ

“I was not aware so at first I felt that why are so many messages being delivered. When I checked the notifications, and saw so many OTPs, I got a little frustrated and was scared. Where has my number been leaked?,” Prashasti recalled.

Aryan revealed how the teacher he attacked thought that their phone was “hacked.”

“He was saying that someone is trying to hack into my phone but is not being able to. He was joking that students are being mischievous,” he says. 

Both Prashasti and Aryan said that the messages were fake OTPs claiming to be from apps that were already downloaded on their phones.

“Only OTPs are delivered. Sometimes from Meesho, Rapido, Uber etc. No banking OTPs or anything related to banking. Or anything related to payments...their OTPs are not received.,” says Aryan. 

When asked if they received more spam messages after the attack, Prashasti said that “For a while I was receiving sponsored messages, company advertisements that I had not received earlier”

Aryan, however, denied that he received more spam messages after he was attacked by his friend. 

The Hindu could not independently verify any proof of the user’s data being sold to commercial companies. 

Promoted through Telegram

Phone bombing websites have dedicated Telegram channels through which the service is promoted, and links to websites are openly shared. A Telegram channel The Hindu gained access to had 558,064 subscribers at the time of publication. Other messages from the channel include announcements by the admin about when the website is taken down and when it is back up.  The Telegram groups also sell fake Instagram subscribers at a fee. The Hindu found a message advertising a ‘pro’ subscription-based variant of the pranking service with additional services like ‘WhatsApp bomber’.

If someone is phone-bombed, the websites provide what is called a ‘protection list.’ One can add their number to the website and be “permanently shielded” from the bombing “services.” Victims cannot, however, ascertain which website was used to harass them in the first place. There exists no global website to totally ‘shield’ oneself from all such attacks.

Legal aspect

Lawyers, when asked about the phone bombing and whether victims have any recourse after being attacked, highlighted specific laws relating to online harassment and digital offences that make phone bombing an illegal act.

“Section 43 and section 66 of the IT Act specifically provide for penalties both under the civil and criminal law for computer related offences. The penalty carries a maximum imprisonment of 3 years or fine of Rs. 5 Lakhs. Section 43(c) specifically deals with any “introduction of any computer contaminant” and Section 43(d) “damages or causes to be damaged any computer, system or network or any other program” and Section 43(e) which punishes any “disruption” of the computer or network or system. Every act of phone bombing specifically causes such a disruption and is therefore punishable on every count,” says Nipun Saxena, Advocate, Supreme Court.

“Even if it is a harmless prank, they are perhaps doing to people who they know and are doing to trouble those people. Phone bombing like this can basically prevent you from using your phone. Disturb your sleep, affect your day. You might live in fear that you might get so many calls again and again. It disrupts the integrity of a system which is essentially based on trust,” says Krishnesh Bapat, advocate, Supreme Court.

“Your mobile number is personal information. That is being used in a way you would not desire. When you give someone your mobile number, the idea is that they would make you a call to connect with you not harass you. You have not consented to being bombed through automated requests,” he adds.

While the cases of digital harassment are scattered and often anonymous, victims can seek help from the law if they have been phone bombed.

Banning is the solution?

“I feel like this should be banned. Anyone would panic that their phone has been hacked. If you are a novice user, it would be like what is happening. That’s why I feel that it should be banned,” says Prashasti.

However, with absolutely no oversight, banning a single website cannot stop phone bombing from taking place.

“Any ban needs to be in accordance with Section 69(A) of the IT Act which circumscribes how the ban operate. The exercise must be proportionate in nature if perhaps there is a genuine use case of such website, where you need to make repeated calls. Perhaps if in times of emergency to someone, a tool like this might help. It would make repeated calls to get someone’s attention in times of emergency. Would that also be impermissible is something that would have to be seen in the context of the situation. The proportionality bit is important. Only the bit with using for phone bombing can be taken down,” says Advocate Bapat.

With inputs from Aniket Singh Chauhan