Your phone rings at 11:43 AM. Unknown number. You answer because it might be your kid’s school. It’s a man reading from a script about a home loan you didn’t ask about.
You registered on India’s Do Not Disturb registry three years ago. You’ve gotten eight calls like this today.
You’re not doing anything wrong. The system is broken by design — and the people running it know it.
You’re on DND. The calls keep coming.
The National Do Not Disturb registry exists. You can register on it. TRAI maintains it. And if you’ve been on it for more than a year, you have noticed that it does almost nothing.
This isn’t a bug in implementation. It’s the predictable result of how the system is structured — who it covers, who it exempts, and who it has no power over at all.
What DND is actually supposed to do
TRAI’s NDNC (National Do Not Call) registry, now branded as the DND registry, was set up to stop registered telemarketers from calling you for unsolicited commercial communication. The theory is simple: you register your number, telemarketers check the registry, they skip your number.
Registered telemarketers in India must obtain commercial communication headers from TRAI — the alphanumeric sender IDs you see on promotional SMS messages like “VM-HDFCBK” or “JD-JIOOFF.” These are the entities DND is designed to regulate.
For that narrow category of caller, DND technically works. A legitimate bank with a registered header should not be cold-calling DND-registered numbers for unsolicited offers.
The problem is that this narrow category covers almost none of the spam calls you actually receive.
The exemptions that swallow the rule
The TRAI framework carves out a vast category of calls as transactional or service communication — and exempts them from DND entirely.
Banks can call you about loan offers if they have an existing relationship with you. Insurance companies can call you about policy renewals. Mutual funds can call you about investment opportunities. Government services can call you about anything. Any company that can claim a prior relationship with you can call your DND-registered number. And “prior relationship” is defined loosely enough that buying a SIM card from Jio qualifies.
These exemptions cover the majority of spam calls Indians actually receive. The person calling about a home loan from “HDFC” — real or fake — falls under the transactional exemption. The insurance upsell from a call center in Gurugram is “service communication.” The credit card offer from a number you don’t recognize is “relationship-based marketing.”
DND was never going to stop these calls. The exemptions exist because the banking and insurance lobbies pushed for them, and TRAI accommodated.
Spoofed numbers: TRAI’s blind spot
Here is the harder problem. A growing fraction of spam and scam calls don’t come from registered Indian telemarketers at all.
Scammers use VoIP (Voice over Internet Protocol) services to make calls from servers in Bangladesh, the UAE, Singapore, and the United States — then spoof an Indian mobile number as the caller ID. The number that shows up on your screen may be a legitimate Indian mobile number belonging to someone who has no idea their number is being impersonated.
TRAI regulates Indian telecom operators. It has no jurisdiction over a SIP trunk operating from a data center in Dubai. The DND registry has no mechanism for these calls. The AI spam detection systems being rolled out at the carrier level help identify suspicious call patterns, but they’re playing catch-up against an adversary that changes infrastructure constantly.
When you get a call from what looks like a +91 mobile number but turns out to be a scam — the Customs officer scam, the FedEx parcel scam, the fake CBI notice — that call almost certainly came from outside India’s regulatory reach.
How scammers get your number anyway
Even if DND perfectly blocked every regulated telemarketer (it doesn’t), and even if TRAI somehow gained authority over overseas VoIP operators (it hasn’t), the scammers would still have your number.
They buy it. Bulk phone number lists are sold openly on Telegram channels and dark web marketplaces for a few hundred rupees per lakh records. These lists are assembled from breached databases. Telecom companies, fintech apps, e-commerce platforms, and government portals have all suffered data breaches in the past five years. Once your number is in a breach, it enters a resale ecosystem that DND has no access to.
Your number is also on data broker websites that aggregate publicly registered information, app permissions, and breached data. Anyone willing to pay, or willing to scrape, can get a list of Indian phone numbers with names and addresses attached.
DND tells legitimate telemarketers to skip your number. It tells exactly nobody to delete your number from their database.
What TRAI is doing (and why it’s not enough)
TRAI is not ignoring the problem. In 2023 and 2024, it pushed Indian telcos to implement AI-based spam call detection at the network level. Airtel launched its AI-powered spam detection system in 2024. Jio has similar filtering built into its network.
These systems work by analyzing call patterns — an entity making 10,000 calls in an hour from the same number is automatically flagged. They’ve reduced some categories of spam. They don’t stop spoofed VoIP calls that look like individual mobile numbers. They don’t stop manual call center dialing. They don’t stop calls from exempted categories.
TRAI also runs the Sanchar Saathi portal where you can report spam calls. Filing a report creates a record. Whether that record results in any action depends on whether the caller is an identified, regulated Indian entity — which, as covered above, many are not.
Reporting is worth doing. It is not a solution.
What actually works
The only thing that reliably reduces spam calls is reducing the number of places your phone number exists.
Your primary phone number — the one linked to your Aadhaar, your UPI account, your bank, your employer — is already in too many places to fully clean up. But you can stop it from spreading further.
Use a secondary number (a cheap prepaid SIM or a virtual number service) for app registrations, food delivery, e-commerce, and any form that asks for your phone number but doesn’t need to be linked to your real identity. Your primary number stays clean. The secondary number gets the spam.
Where your number is already out there, you can get it removed. Data broker websites — the ones that list your name, phone number, and address — accept removal requests. Under the DPDPA, Indian companies must honor those requests. The problem is there are hundreds of these sites, each with its own process. KnytX Shield is built to automate this: once it launches it will identify where your number is listed and submit removal requests on your behalf.
For a full guide to tools that help you limit how much of your real contact information you share, see email aliases and phone masks. For how to get your data off Indian broker sites specifically, see removing your data from the Indian internet.
The DND registry was designed for a world where spam came from domestic telemarketers with registered headers. That world ended years ago. The solution isn’t a better registry. It’s limiting the attack surface — the number of databases your phone number lives in.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.