We hand out our phone numbers constantly. Banks want them, stores want them, apps want them, and half the internet seems convinced it needs one before letting us create an account. At this point, you should probably assume your number has ended up in more places than you remember.

But that doesn’t mean anyone who finds it can hack your phone or empty your bank account. A phone number by itself is fairly limited. The problem is that it’s often attached to other important information, such as your name, email address, online accounts and, sometimes, much more personal information.

That’s why your phone number is worth treating like the personal information it is. You don’t need to worry just because somebody has it, but you should understand what they can actually do with it, what signs may suggest something more serious is happening and how to make your number less useful to bad actors.

This article was made possible in part by Incogni. It was written and edited independently without partner oversight.

What can someone with your phone number actually do with it?

ThamKC/Shutterstock

Your phone number is more widely available than you might think (like a lot of your personal info). You may have put it online yourself years ago, on a social media account, job listing, professional profile or some other forgotten corner of the internet. Depending on your privacy settings, some platforms even let people find your account by searching for the phone number attached to it.

Then there are data brokers and people search sites, which collect information from public records and commercial sources and package it into profiles. Your number may show up alongside your name, email addresses, old addresses, names of relatives and even your public records. 

Retailers, apps, loyalty programs and other businesses collect phone numbers, too, so there are even more places for that information to live. Your phone number can then be exposed in data breaches, which are getting bigger than ever. 

A phone number by itself isn’t especially useful, but it becomes more complicated when it’s connected to your other personal information.

A phone number alone doesn’t get a bad actor very far. Someone having your phone number doesn’t give them remote control of your phone. They can’t type it into a website and start reading your texts, dig through your photos or anything like that. The trouble starts when they use it to come after you or connect it to other information.

Someone with your phone number could:

• Send phishing texts or scam calls: They can pose as your bank, a delivery company or another familiar organization and try to get passwords, payment information, verification codes or other sensitive data.
• Dig up more information about you: People search sites, social media and other databases can connect your number to your name, email, address or other details.
• Attempt a SIM swap or port-out: With enough personal information, someone could impersonate you to your carrier and try to take control of your number. If it works, your calls and texts go to them instead.
• Try to reset your accounts: Especially if the bad actor has completed a SIM swap, they may be able to trigger a password reset or verification code. Don’t ever give an authentication code to someone who asks for it.
• Spoof your caller ID: A scammer can make your number appear on somebody else’s caller ID without ever gaining control of it.
• Use it for identity theft: A phone number isn’t enough by itself, but combined with your name, birth date, Social Security number or other sensitive information, it can help someone commit identity fraud.
• Make your phone annoying: Robocalls, spam texts, marketing messages and unwanted signups are the more common possibilities.

All this is to say, someone who can connect your phone number to a pile of other information about you has considerably more to work with.

How to tell if someone is misusing your phone number

Just because your number turns up on a people search site or you get hammered with spam calls for a week doesn’t mean somebody has taken over your phone. Spam is mostly just spam.

But if someone is actually using your phone number against you, it’s time to be concerned. Here are a few things to look out for:

• Authentication codes you didn’t request: Someone may be trying to get into your account. Not usually an issue on its own — and usually associated with people finding your email address instead of your phone number — but be sure to change your password.
• Unexpected password resets: The same goes for reset emails or texts you didn’t initiate. Be aware that some scammers create fake versions of these communications in attempts at phishing people out of their accounts. If you’re unsure, don’t click any links in the email; instead, go directly to the website.
• Unfamiliar login alerts: Check warnings about new devices or suspicious account activity.
• Carrier changes you didn’t make: SIM, eSIM and number transfer notices deserve immediate attention.
• Calls or messages you didn’t send: If people say your number is contacting them, it may be caller ID spoofing.
• Sudden account lockouts: If your credentials suddenly don’t work, find out why.

One of the biggest warning signs is suddenly losing cellular service for no obvious reason. If your phone was working normally and now can’t make calls, send texts or connect to your carrier, particularly if other account or carrier alerts start showing up at the same time, call your carrier immediately. You could be dealing with a SIM swap or unauthorized number transfer.

Make your phone number less useful to bad actors

Trying to keep your phone number completely private is probably a lost cause. You’ve likely handed it to many companies and websites over the years. A better approach is to make sure the number itself is fairly useless to anyone who gets their hands on it.

• Lock down your carrier account: Use a unique password and account PIN, turn on MFA — or multifactor authentication — and enable any number or port-out lock your carrier offers. A SIM PIN protects the SIM itself, but carrier protections guard you from fraudulent transfers.
• Use better MFA: SMS codes are better than nothing, but authenticator apps (I use Authy) and hardware security keys are more resistant to SIM swapping attacks.
• Use passkeys: They’re resistant to phishing and don’t depend on passwords or texted security codes.
• Stop reusing passwords: A password manager can generate and remember a different strong password for every account.
• Get your number off public profiles: Remove it from social media, job boards and other public pages. Disable phone number searches on social accounts where you can.
• Clean up data broker listings: You can opt out yourself or pay a data removal service to do the legwork. Just don’t expect your information to disappear forever.
• Consider a second number: A prepaid line, secondary SIM/eSIM or Voice over Internet Protocol number can handle less important accounts. Note that some banks and other sensitive services won’t accept VoIP numbers.
• Secure your phone: Use a strong passcode and biometrics, install updates and get rid of app permissions you don’t need.
• Don’t trust unexpected requests: Never hand over an authentication code or click a link because some text says there’s an emergency. Go directly to the company’s app or website, or call a number you know is legitimate.

What to do if your phone number has been compromised

Someone knowing your phone number isn’t a reason to change every password you have or get a new number. But if your phone suddenly loses cellular service for no obvious reason, call your carrier immediately from another phone. Ask whether someone activated a new SIM or eSIM, transferred your number, turned on call forwarding or changed anything else on the account. If your number was hijacked, get it restored and add whatever transfer locks and account protections your carrier offers.

Then check your primary email account. That’s the important one because access to your email can be used to reset passwords elsewhere. Check your bank, social media and other important accounts for logins you don’t recognize, changed recovery information, messages you didn’t send or transactions you didn’t make.

Change passwords where there’s evidence of trouble, kick out unfamiliar sessions and replace SMS authentication when you can. If someone is pretending to be you, tell your friends and family to ignore strange requests for money or anything else.

If you’ve lost money or someone is using your identity, contact your bank or other affected institutions, consider freezing your credit (with Equifax, Experian and TransUnion) and file a report through IdentityTheft.gov. Save screenshots, carrier correspondence, transaction records and case numbers while you’re at it.

Getting a new phone number should usually be near the bottom of the list.

Treat your phone number like personal information

Your phone number isn’t a password (and it shouldn’t be used as one), and knowing it doesn’t automatically give someone the keys to your digital life. The trouble starts when that number can be connected to everything else you’ve scattered around the internet.

You probably can’t keep your phone number secret forever. Just be stingy about where you hand it out, and make sure knowing your number alone doesn’t get anyone very far.

Marshall Gunnell is a Tokyo-based tech journalist and editor with over a decade of experience covering IT, cybersecurity and data storage. Alongside CNET, his work has appeared in ZDNET, Business Insider, PCWorld, How-To Geek, Zapier, StorageReview and many other leading outlets. Known for translating complex topics into clear, actionable insights, his articles have been read more than 100 million times worldwide.

See full bio