My first conversation with Alan Mamedi, the 38-year-old CEO and Co-founder of Stockholm-based caller ID and spam detection app Truecaller happened to be on the micro-blogging site Twitter in January 2020, when I had tweeted, “Life would be better if Truecaller starts telling us WHY the person is calling.” “Noted!” Mamedi had replied then. Merely nine months later, Truecaller was live with its new feature, Call Reason, a new way to tell people why you’re calling.

User feedback like this is essential for Mamedi, who believes in an open and liberal feedback mechanism. Starting out as a Kurdish refugee in northern Sweden, he co-founded Truecaller with his friend Nami Zarringhalam in 2009, which now counts India as its biggest market with nearly 77 per cent of its user base, or 235.5 million active users, located here. Moreover, its data says that a typical Indian phone user receives about 17 spam calls a month on average, as compared to the highest-spammed country Brazil, where users receive around 33 spam calls per month on average. It further says that globally, it has identified and blocked 37.8 billion spam calls in 2021.

With our technology and data, Truecaller solves many more issues than a basic number identification service. We believe that the proposed TRAI development can even be a driving catalyst for our continued growth in India

Alan Mamedi
CEO and Co-Founder
Truecaller

Shockingly, 202 million of those calls were made by just one spammer in India, per its 2021 Year in Calling report. And the fact that India has moved from the 9th spot to the 4th in 2021 in a list of countries where users receive the most number of spam calls, makes an app like Truecaller even more relevant. “There’s no secret sauce behind our success here. It’s a combination of our focus on emerging markets as it’s underserved and it was a well-suited time for India, since in the last 10-15 years, it has gone through a massive smartphone and data penetration revolution. As that happens, people need utility apps that solve core problems,” says Rishit Jhunjhunwala, Chief Product Officer and MD of Truecaller India, who moved back to the country last October from Sweden to focus on the company’s India operations. He adds that in India—traditionally considered as a market that doesn’t like to pay for software—the company’s revenue from subscriptions has grown considerably.

While the Sequoia India-backed Truecaller is synonymous with caller ID and spam detection, it also helps users identify callers by providing a search engine for telephone numbers. As a result, it has been widely criticised for its practice of automatically uploading its users’ phonebooks to its servers without their consent. The company, however, says that its database is mostly user generated and a large number of daily active users (DAU) contribute to it by marking numbers as spam, correcting names, etc. According to Jhunjhunwala, it’s nothing but a big misconception against the company. “It’s a common misconception that Truecaller uploads things to the server and sells data. Another misconception is that we’re a Chinese company, and that’s why the defence forces sent out an advisory against installing Truecaller. We’re actually way ahead of many of the apps in India in terms of how transparent we are with user privacy,” says Jhunjhunwala.

By introducing the Call Reason option—its most requested feature in 2020—that helps users send a note with their outgoing calls along with features like bill reminders, inbox cleaner and an SMS organiser, Truecaller wants to pivot to a more active-usage app rather than being a predominantly ‘background app’. “Caller ID and spam detection are passive ‘install and forget’ kind of features. Five or six years ago we realised that we need to become more of an active app. And we need to make the inside of the app a lot more useful. That’s why we added dialler capabilities and introduced messaging where all SMSes are decluttered,” says Jhunjhunwala.

Philosophically, we want to make money from very transparent sources. We want to stay profitable so that our users don’t think that these guys are one day going to get desperate and sell our data

Rishit Jhunjhunwala
Chief Product Officer & MD
Truecaller India

Following the acquisition of Israel-based start-up CallHero in January 2022, Truecaller is now working on an AI-enabled assistance service which will have the ability to answer, filter and manage calls on the user’s behalf. Jhunjhunwala, however, doesn’t like to refer to this pivot as ‘de-risking’. “These moves are not in reaction to anything. Our vision is to make communication more efficient,” he adds.

In 2017, the company also launched a Unified Payments Interface (UPI) service called Truecaller Pay, which at its peak in mid-2020, had close to 20 million registered users. It also offered services like bill payments through its banking partners like ICICI Bank and Bank of Baroda. Mired in controversy, it had to discontinue the UPI service last year, but more on that later.

Making it Rain

Last year, Truecaller’s total revenue stood at SEK 1.12 billion (roughly Rs 818 crore per the exchange rate on October 10, 2022), of which India contributed SEK 787 million (around Rs 575 crore), which works out to almost 70 per cent of the company’s total revenue, per the company’s consolidated financial report for CY21 filed with Nasdaq Stockholm. Furthermore, per the company’s Indian subsidiary’s financial statement filed with the Registrar of Companies (RoC), its India operations reported annual revenues of just Rs 130 crore in FY21. Which means that there’s a gap of around Rs 400 crore in the company’s revenues reported in India versus its India figures reported in Sweden despite the fact that Sweden follows a calendar year reporting format and Indian companies follow the financial year timeline. When quizzed about it, the company’s spokesperson said, “The annual report figures are the official numbers used by us as a listed company. However, you pose a valid question about the difference in figures. The reason for this difference in the annual reports is due to the accounting treatment/rules when consolidating the figures from different subsidiaries in the group.”

While globally, the company reported a profit of SEK 856 million (roughly Rs 625 crore) in CY21, its Indian subsidiary, Truecaller International Limited Liability Partnership, reported a loss of Rs 11 crore in FY21. “We have been profitable for many years now. Philosophically, we wanted to be the company that makes money from very transparent sources. We have ads, premium subscriptions and Truecaller for Business,” says Jhunjhunwala. We wanted to stay profitable, he adds, so that our users don’t think that “these guys are one day going to get desperate and sell our data”.

Recently, the company’s stocks crashed after US-based investigative financial research group Viceroy Research said in a report that global privacy and data protection laws would soon make Truecaller’s business model redundant. It also suggested that the company is “skirting regulations” and/or avoiding taxes through “uncreative loopholes”, which will inevitably be cut off. The Viceroy report further states, “When the taxman comes knocking, Truecaller is a loud and proud Swedish company. It bills almost exclusively from Sweden from advertising customers/agents despite substantially all operations being in India.” The report further states that they believe that Truecaller has failed to adhere to transfer pricing principles and is avoiding higher tax rates in India. It then adds that “It pays taxes almost exclusively in Sweden. This is despite all processing risk and operations being carried out in India.” Meanwhile, Truecaller’s Indian subsidiary, in its audited report for FY21, stated that “The LLP is in the process of conducting a transfer pricing study as required by the transfer pricing regulations under the IT Act to determine whether the transactions entered during the year ended March 31, 2021 with the associated enterprises were undertaken at [an] ‘arm’s length price’.”

Globally, the free-to-use app earns nearly 84 per cent of its revenues from in-app advertising. “Truecaller ads have been a gateway in helping brands reach out to millions of users in a short amount of time. It is unobtrusive and will never take over your phone screen,” says Mamedi about the app’s advertising business. A smaller revenue stream is its Gold and Premium subscriptions, priced at Rs 4,999 per annum and Rs 549 per annum, respectively, in India. Premium subscriptions allow users to use the app without ads and unlocks features like advanced spam blocking and contact requests among others, while a Gold subscription gives them all that and makes them eligible for a gold badge and priority services.

Last year, the company also forayed into its third revenue stream, ‘Truecaller for Business’, to help businesses connect with their customers in a more trusted and efficient manner. For a monthly call volume of 50,000, the app charges businesses Rs 15,000-19,500 per month depending on their requirements. “The solution allows businesses to verify their identity by adding the correct name, brand logo and a green caller ID. This is especially important because a lot of scammers now try to impersonate brands. There is high potential for this, not just in India but in any market where there is a need for businesses to make a trusted connection with potential and existing customers,” says Mamedi.

For now, Truecaller for Business has over 1,000 active business customers across 33 countries. “We are seeing traction across categories of businesses with use cases around service, support and fulfilment, ride hailing, logistics and delivery, marketing, sales, security and fraud management,” he adds. Business owners can create their profiles with information like address, website, email and business hours—like Google Maps does. It is also revamping its Truecaller Priority service to distinguish between valid business and spam calls. The company identifies calls based on colours. Blue is for standard, red means spam/scam/harassment while green are calls from a verified business and purple is a priority call that has use cases for companies that operate in e-commerce, cab hailing and other fields that need a user’s immediate attention.

TRAI Calling

The Telecom Regulatory Authority of India (TRAI) has been asked by the Department of Telecommunications to develop a Truecaller-like caller identification service. According to experts, the service will display the caller’s name based on the Know Your Customer information collected during the purchase of a SIM card, and will require a collaborative effort from all major telecom operators. Truecaller, however, does not see the development as a threat. “Based on the information available at present, we do not see this as a competitive service comparable to the full range of services that Truecaller offers. With our technology and data, Truecaller solves many more issues than a basic number identification service. We believe that the proposed TRAI development can even be a driving catalyst for our continued growth in India,” Mamedi said in a statement.

For Jhunjhunwala, it’s more like a validation of their product. “Our initial thought was that after more than a decade of being in the business, we actually got validation from a respected authority that this problem is worth going after. We’re looking forward to the public consultation when it opens up. Over the years, we have moved further from just caller ID and spam detection and expanded our offerings. Those additions will help us continue to retain our market share,” he says, adding, “Yet, I don’t want to discount what TRAI is doing.”

Amit Dubey, a Delhi-based cybercrime expert, however, feels that the Indian government’s app will threaten the pole position of Truecaller since the majority of its use case is still caller ID and spam detection. “If the government takes up this initiative, it will be a threat for Truecaller. They will be able to give a better experience to users because of their integration with telecom companies and a bigger database,” he says. Dubey also questions Truecaller’s ability to actually battle scams. “I’m not sure how effective it is in battling scams because criminals don’t use a number for more than a week, and by the time it catches them, the number is not in use. To some extent, it is useful in the sense that the app gives detailed graphical analysis of that number, making it easier for a user to identify a scam pattern,” he adds.

The Privacy Question

The Supreme Court had ruled that the right to privacy is a fundamental right under Articles 14, 19 and 21 of the Constitution in the case of K.S. Puttaswamy vs Union of India, in 2017. This piece of information coexists with the fact that India still does not have a proper data protection law. This legal vacuum has left Indians vulnerable to activities like monitoring, surveillance and monetisation of user data from various quarters. “Currently, India is in a grey zone because we don’t have a data protection law. As of now, there’s no stopping anyone from copying, monetising, using, forwarding and sharing data with others. There are rules under the IT Act but they are hardly ever implemented,” says cybersecurity expert and Supreme Court advocate Pavan Duggal.

Experts argue that a majority of Truecaller’s datasets have been collected without the consent of its users. “It will be a gross violation of my privacy if my data is used for monetisation purposes. I can go ahead and tell the government to stop apps like Trucaller which are harnessing my data. These numbers are taken from the devices themselves by the app. That’s a violation of both the IT Act, 2000 and the right to privacy. We haven’t yet woken up to the power of our data, and that is the reason we don’t go after such things. It’s only a question of time before these things get regulated,” Duggal adds.

Mamedi says that Truecaller is and will continue to be fully compliant with all Indian regulations, including the data protection law when it is in place. “We capture only the data needed for the service to function and nothing more. We are compliant with data privacy laws and stand ready to comply with other data protection laws anywhere in the world,” he adds. Incidentally, Truecaller has been in the soup for data security issues a number of times in the past. In 2020, a data breach at Truecaller—that led to the  personal details of 47.5 million Indians being sold on the dark web for around $1,000 (Rs 76,000)—was reported by US cyber intelligence firm Cyble Inc. It contained details like the user’s name, gender, age, city, telecom service provider, Facebook account, email id and mobile number. In the same year, the Indian Army banned its personnel from using 89 apps including Facebook, TikTok, Truecaller, Instagram, Tinder, PUBG, etc. owing to national security risks.

Experts have also called out Truecaller’s access to user’s text messages, which can potentially give hackers access to sensitive financial information in case of a breach. Incidentally, in 2019, an SMS was automatically sent out without users’ consent to ICICI Bank due to a ‘bug’ in the app. “Due to this anomaly, some of our users automatically initiated the creation of a payments profile that they never requested for,” Mamedi later wrote on the Truecaller website. He apologised and took quick action to delete the accounts of affected users.

Moreover, a recent petition in the Bombay High Court alleged that Truecaller collects its users’ data and shares it with its partners without their consent, and then dumps the liability on the users. Meanwhile, Truecaller in a statement said that the PIL’s claim that it shares data with certain third parties to benefit from them financially, “is false information”. The company has repeatedly denied any exploitation of its systems or processes. “At Truecaller, we believe that a strong, robust data breach response plan is crucial. We have a large, multi-disciplinary team working to ensure that the data we capture is safe with us,” says Mamedi.

The app was also at loggerheads with tech giant Google, over its decision to disallow third-party call-recording apps on the Play Store. As per a directive from Google, starting May 11, 2022, it has banned all such apps on the Play Store. Following this, Truecaller had to drop its call-recording feature across the globe. According to Duggal, companies like Truecaller look for locations where there’s either minimum or no protection of data. “India is seeing a very unique policy vacuum. India doesn’t have a dedicated law on data protection. We also don’t have a dedicated law on privacy, or on cybersecurity. Absence of these regulations is a fertile field for any company,” he adds. While Truecaller has proactively localised all Indian citizens’ data within servers in India, it will hardly be helpful in case of a potential data breach.

The Cost of Convenience

To access Truecaller’s caller ID features and other app functions, one has to give access to one’s contact list, including details of people who have not downloaded the app and given consent to have their numbers identified. To this, Jhunjhunwala says that even if someone is not a Truecaller user, they can remove their data. Rather than a delisting feature, this should be a voluntary joining feature, experts point out. “We don’t hide that fact at all. You will find how to delist your number on our website. We have also applied control mechanisms that users have on their data. There are terms of service which people say yes to. That’s not something we wanted to hide behind,” he adds.

He further says that Truecaller doesn’t show the full terms of service upfront but a neatly formatted summary written in plain English, and not in legal gobbledegook, so that everybody can understand it. “Then, if you want that legal document, you have access to the full terms of service,” he adds. Duggal, meanwhile, says that even in that legal document, nobody explicitly gives the consent to monetise their data. “Merely because someone is ignorant of the law, does not mean that they should be made a victim. If there’s more awareness, people will prefer to not use apps like Truecaller,” he adds.

Dubey, however, isn’t oblivious of the other side of the coin. “Yes, they’re profiling users without their consent but it’s also debatable. If someone is calling them, they have all the right to know who is calling. An app like that also has a lot of advantages for its users,” he says.

Duggal disagrees. “Yes, it’s convenient to know who’s calling but that doesn’t mean they have the right to put someone’s number on a public platform,” he says. Experts are banking on the new data protection law in the upcoming budget session to address some of these issues as a starting point. Although users get the convenience of caller detection and spam recognition, it comes at the cost of digital profiling and a potential data breach. The ball is now in the government’s court to turn it into a fair playing ground.