Your phone number links more of your life than you think

Count how many times this week someone asked for your phone number. The pharmacy, to find your prescription. The checkout, for loyalty points. A delivery app, the dentist's reminder system, a website that wanted to "verify it's you". Each request feels small. Together they have turned a ten-digit number into one of the most useful identifiers about you, in some ways more useful than your name. Thousands of people share a name, while a mobile number usually belongs to one person for years, through moves, job changes and new email addresses.

That makes the number worth protecting in a way most people never think about. It is a login, a recovery key, a search term on people-search sites and, for a scammer, a route into accounts that have nothing to do with your phone. Here is where your number lives, how it gets misused, and what to change.

Where your number is doing more work than you realize

It is a username

Plenty of services let you sign in with a phone number instead of an email address, and the big messaging apps were built around it. Anyone who has your number can often see that you have an account and sometimes your profile photo. Check the privacy settings in each messaging app you use. WhatsApp lets you limit who sees your photo and status. Signal now lets you set a username, so you can share that instead of your number with people you don't know well.

It is a recovery key

"Forgot your password? We'll text you a code." That one line means whoever receives your texts can reset the password. When I worked on account security, recovery was where most of the real fights happened, because the sign-in page was usually locked down and the reset flow was not. If your email account, your bank and your password manager can all be reset by text message, your phone number is effectively the master key to all three.

It is a second step

Text message codes are still the most common form of two-step sign-in. They are better than a password alone, but the FTC's advice on SIM swap scams puts the weakness plainly: text message verification may not stop someone who has taken over your number.

It is a matching key in other people's files

Marketers and data brokers use phone numbers to join records together. A loyalty program, a warranty card, a sweepstakes entry and an app sign-up might each spell your name differently or carry an older address, but if they share a phone number, they are easy to connect. Because people keep a mobile number for so long, it ties together records from different parts of your life that would otherwise be hard to match.

It is on caller ID

When you call someone, the caller ID name they see is not sent by your phone. In the US, the carrier on the receiving end usually looks your number up in a caller ID name database, often called CNAM, and shows a short label of up to 15 characters. Whether your name appears depends on the carriers and databases involved, which is why the same call can show your full name on one phone and only a city on another. Our page on phone directories and unlisting explains where those names come from and how listed numbers ended up in people-search data.

It is a search term

Reverse phone lookup sites let anyone type in a number and get back a name, an age range, past addresses and possible relatives. A typical result might read "Jane Example, 40s, Sample City, possible relatives: John Example", stitched together from the same public records and marketing data that feed people-search listings. Search your own number on a few of the large sites and you will see what a stranger with your number can learn.

SIM swaps and port-outs: the attack that follows your number

A SIM swap is simple and brutal. The FTC describes the usual version: a scammer calls your carrier, says your phone was lost or damaged, and asks for your number to be moved to a new SIM card in a phone the scammer controls. A port-out is the same idea with a different route: the scammer opens an account at another carrier and asks for your number to be transferred there. Either way, your phone goes quiet and their phone starts receiving your calls and your codes. From there, the scammer works through password resets on your email, your bank and anything else that trusts a text message.

It is not a fringe problem. In a 2022 warning, the FBI's Internet Crime Complaint Center said it received 1,611 SIM swapping complaints in 2021, with adjusted losses of more than 68 million dollars, against 320 complaints in the three years before that.

Regulators have pushed back. In November 2023 the FCC adopted rules that require wireless carriers to use secure methods to confirm a customer's identity before moving a number to a new SIM or a new carrier, to notify customers immediately when either kind of request is made on their account, and to offer customers a way to lock their accounts against those changes. That notification is your early warning. If you get one and asked for nothing, treat it as an emergency rather than a glitch.

The signs to watch for:

• Your phone shows no service, or emergency calls only, in a place where it normally works and other people's phones have signal.
• A text, email or app notice says your SIM was activated on a new device, or that a transfer was requested.
• Password reset emails arrive that you didn't request.
• Texts from your bank or friends stop arriving.

If it happens, contact your carrier from another phone or a computer straight away and ask them to restore your number and freeze changes on the account. Then change your email password, check your bank and card accounts, and turn on stronger two-step sign-in wherever the scammer might have been. If you think they also have your Social Security or bank account number, the FTC points victims to IdentityTheft.gov for a recovery plan.

Lock the carrier account first

Your carrier account is the account that protects your number, so it gets attention before anything else.

1. Set an account PIN or passcode with your carrier. Make it unrelated to your birth year, your address or the last digits of your Social Security number, and different from your bank card PIN. The FTC recommends this step directly.
2. Turn on the carrier's lock features. At the time of writing, Verizon offers Number Lock and SIM Protection, T-Mobile offers SIM Protection and a port-out protection setting, and AT&T offers Wireless Account Lock. The names and menus change, so look in your carrier's app or account settings for anything that mentions SIM changes, number transfers or account locks.
3. Protect the online carrier account itself with a password no other account uses and two-step sign-in through an app rather than texts.
4. Learn how to turn the locks off before you need to. When you switch carriers or buy a new phone, you will have to lift them, and it is easier to do on a calm afternoon than in a store with a salesperson waiting.
5. Post less. The FBI's warning suggests limiting how much personal information, phone number included, you share online, because every detail makes it easier to impersonate you to a carrier.

Move your important accounts off text messages

The carrier lock makes a swap harder. Moving your key accounts off text codes means a swap gets the scammer much less if it happens anyway.

Start with the accounts that can reset other accounts: your email, your Apple, Google or Microsoft account, and your password manager. Then your bank and card issuers. For each one, switch the second step to an authenticator app, a security key or a passkey, and print the recovery codes. If a service insists on keeping a phone number on file, leave it as a backup, not as the only way in. I covered the methods, from weakest to strongest, in the piece on password managers, passkeys and two-step codes.

While you are in those settings, remove old numbers. Carriers hand disconnected numbers to new customers, and the FCC even runs a reassigned numbers database so callers can check whether a number has been disconnected since someone gave it to them. If your recovery options still list a number from three phones ago, a stranger may now be receiving your codes.

If a breach letter tells you your phone number and carrier account details were exposed, set the carrier PIN that same day, and work through the rest of the first-hour routine after a data breach letter.

A second number for everything else

Not every form deserves your real number. A second number, from an internet calling service or a cheap prepaid line, can take the loyalty programs, marketplace sellers, sign-up forms, contractors and dating apps. Your real mobile number stays with your bank, your carrier, your doctor and the people you actually talk to. The second number still collects spam and still ends up in marketing files, but it is not the key to your accounts.

A few cautions. Some banks and apps refuse internet-based numbers for verification codes, so expect the occasional form that insists on a mobile number. Never use the second number as the recovery option for an important account. And keep it active: free numbers can be reclaimed by the service after a stretch of no use, and someone else may get yours.

Getting your number out of reverse lookups

Reverse lookup results usually draw on the same profiles as people-search listings, so removing your listing from a site often removes the phone result too. Search for your own number, note every site that returns a profile, and use each site's opt-out page. Our full opt-out guide lists the large sites and what each one asks for, and the directories page linked above covers unlisting a landline with your carrier.

Two limits are worth knowing. Opt-outs are site by site, and new data can bring a listing back months later, so plan to check again. And the National Do Not Call Registry, useful as it is, only tells legitimate telemarketers to leave you alone. It does not stop scammers, and it does not take your number out of any lookup site.

Ten minutes, this week

• Set a carrier account PIN and write it down somewhere safe.
• Turn on your carrier's SIM change and number transfer locks.
• Switch your email, bank and password manager to an app, a key or a passkey, and print the recovery codes.
• Remove old phone numbers from every account's recovery settings.
• Pick a second number for sign-ups and loyalty cards.
• Search your own number on the big lookup sites and send the opt-outs.

If you only get through the first two, you have closed the door that a SIM swap walks through.