A bug in caller-ID app Truecaller risked its users’ financial data on Tuesday, 30 July. The app, which helps people avoid spam callers, started registering users to the Unified Payment Interface (UPI) account with ICICI Bank without their permission.

Truecaller’s payment service works in India through the its payments partner ICICI Bank, which facilitates UPI service for the platform.

The bug in Truecaller became active when one downloaded the app’s 10.41.6 update.