What a Leaked Phone Number Lets Someone Do

Why Your Phone Number Is More Valuable Than Your Email

Email addresses are easy to change. Phone numbers are not. Most people keep the same mobile number for a decade or more, and it's linked to their identity in more places than they realize:

When your phone number appears in a data breach, its usefulness to attackers doesn't expire.

What Attackers Do With Your Number

#

SIM Swap Attack

The most damaging attack. The attacker calls your mobile carrier, impersonates you using data from the breach, and convinces the carrier to transfer your number to a SIM card they control.

Once they have your number, every SMS-based 2FA goes to them. They then trigger password resets on your email, bank, and any account that uses SMS verification.

SIM swap attacks have been used to steal hundreds of thousands of dollars from individual victims. The attack works because mobile carrier customer service security is inconsistently enforced.

#

Targeted Voice Phishing (Vishing)

Knowing your number, name, and some personal details lets attackers make convincing phone calls pretending to be your bank, tax authority, or an official agency. They already know enough about you to establish credibility.

#

Smishing

Targeted SMS phishing that uses your name and references services you actually use. More convincing than generic bulk SMS.

#

WhatsApp Account Takeover

WhatsApp accounts are tied to phone numbers. An attacker who controls your number can steal your WhatsApp account and access your message history and contacts.

#

Doxxing and Harassment

For public-facing individuals, a leaked phone number enables direct harassment and can be used to aggregate additional personal information.

How to Check if Your Number Was Leaked

Search for your phone number in breach notification databases. Also check if your number is visible in social media profiles, public records, or business listings.

Protecting Yourself

Enable SIM lock / SIM PIN with your carrier. This requires a PIN before any account changes can be made by phone.

Add a port freeze or number lock. Many carriers offer a service that prevents your number from being ported to another carrier without in-store verification.

Switch from SMS 2FA to an authenticator app. SMS codes go to whoever controls your number. An authenticator app (Google Authenticator, Authy) is tied to your device and far more secure.

Use a Google Voice or similar number for public-facing purposes. Registrations, online orders, and anything that requires giving out a number publicly should use a number you can discard.

If You've Already Been SIM-Swapped

Bottom Line

A phone number in a breach is not a minor inconvenience. Enable carrier-level protections, switch from SMS to app-based 2FA for critical accounts, and use a secondary number for any situation where you're required to give one out publicly.

Protect Yourself Today

The #1-rated antivirus covers all the threats mentioned in this article.