It's not hard for apps to commit toll fraud - all it takes is sending SMS or phone calls programmatically. Here's the Google Play page on billing fraud: https://developers.google.com/android/play-protect/phacatego... , and a writeup about malware used for WAP billing fraud: https://www.humansecurity.com/learn/blog/satori-perpectives-... .