Is It Safe To Give Your Phone Number

Tech Fix

I Shared My Telephone Number. I Learned I Shouldn't Have.

Our personal tech columnist asked security researchers what they could find out about him from just his cellphone number. Quite a lot, it turns out.

Credit... Glenn Harvey

Aug. fifteen, 2019

For most of our lives, nosotros have been conditioned to share a piece of personal information without a moment'southward hesitation: our phone number.

We punch in our digits at the grocery store to become a member disbelieve or at the chemist's to pick up medication. When nosotros sign up to utilize apps and websites, they often ask for our phone number to verify our identity.

This column will encourage a new exercise. Before you mitt over your number, inquire yourself: Is it worth the run a risk?

This question is crucial now that our primary phone numbers have shifted from landlines to mobile devices, our virtually intimate tools, which often live with us effectually the clock. Our mobile phone numbers have go permanently attached to us considering nosotros rarely change them, porting them from job to job and identify to identify.

At the same time, the string of digits has increasingly get continued to apps and online services that are hooked into our personal lives. And it can atomic number 82 to information from our offline worlds, including where we live and more.

In fact, your telephone number may have now get an even stronger identifier than your total name. I recently found this out firsthand when I asked Fyde, a mobile security firm in Palo Alto, Calif., to employ my digits to demonstrate the potential risks of sharing a phone number.

Emre Tezisci, a security researcher at Fyde with a background in telecommunications, took on the task with gusto. He and I had never met or talked. He quickly plugged my cellphone number into a public records directory. Soon, he had a full dossier on me — including my proper noun and birth date, my address, the property taxes I pay and the names of members of my family.

From there, it could have easily gotten worse. Mr. Tezisci could have used that information to endeavor to respond security questions to pause into my online accounts. Or he could accept targeted my family unit and me with sophisticated phishing attacks. He and the other researchers at Fyde opted non to do so, since such attacks are illegal.

"If you want to requite out your number, you are taking additional risk that yous might not be aware of," said Sinan Eren, chief executive of Fyde. "Because of collisions in names due to the massive number of people online today, a phone number is a stronger identifier."

There is no simple solution to this. In some situations, giving your digits to institutions like your bank provides an extra layer of security. But in nearly cases, the potential dangers and annoyances of handing out your number outweigh the benefits, every bit you volition read beneath.

How your phone number exposes y'all

It took simply an hour for my cellphone number to expose my life.

All that Mr. Tezisci, the researcher, had to do was plug my number into White Pages Premium, an online database that charges $five a calendar month for access to public records. He so did a thorough web search and followed a data trail — linking my name and address to data in other online background-checking tools and public records — to track down more details.

In an 60 minutes, this is what came upwards:

My current dwelling house accost, its foursquare footage, the cost of the property and the taxes I pay on it.
My past addresses from the terminal decade.
The total names of my mother, male parent, sis and aunt.
My past phone numbers, including the landline for my parents' abode.
Information about a holding I previously endemic, including its foursquare footage and the mortgage taken out on it.
My lack of a criminal record.

While Fyde declined to hack into my accounts using the obtained information and my number, the company warned that there was enough an attacker could do:

A hacker could try to reset my password for an online account by answering security questions like "What is your mother'southward maiden name?" or "Which of the previous addresses did y'all alive at?"
An attacker could employ the personal information linked to my phone number to fox a customer service representative for my telephone carrier into porting my number onto a new SIM card, thus hijacking my digits — a practise called SIM swapping.
A hijacker with control of my phone number could then break into my accounts if I had mechanisms in identify to receive a security lawmaking in a text message when logging in to an online account.
A scammer could besides utilize my hijacked phone number to trick members of my family into sharing their passwords or sending money.
A scammer could also target my phone number with phishing texts and robocalls.
An intruder could use knowledge of my telephone number to call my voice mail inbox and try to scissure the personal identification number to mind to my messages.

Marketers could also take advantage:

An advertizing tech agency could add my number to a detailed profile virtually me, linked to other information about my identity and spider web-browsing activities.
If I signed up for an internet service with my phone number, a brand that bought my digits from an ad firm could upload them into an ad tech tool to correlate the number with my online profile and serve targeted ads.
A shady marketing agency could add my number to a database to blast me with spam calls and text-messaged promotions.

When it's wise to share your number (and when it's non)

In that location are some situations when sharing your phone number is reasonable.

When you enter your user proper noun and countersign to get into your online banking account, the banking concern may call or text you with a temporary lawmaking that yous must enter before you lot tin can log in. This is a security machinery known as two-cistron verification. In this situation, your phone number is a useful extra factor to testify you are who you lot say you lot are.

"A telephone number is a better identifier than just your name, but sometimes you want that," said Simon Thorpe, director of product for Twilio, a communications company that works with phone carriers on combating robocalls.

But which companies should you trust with your telephone number? Hither's where things get tricky.

Plenty of tech companies allow you employ your phone number to protect your accounts from unauthorized admission. But even some legitimate brands like Facebook have been scrutinized for improper use of phone numbers.

Last year, a study past the tech blog Gizmodo found that after a Facebook user set up two-pace verification with his phone number, advertisers that uploaded his digits into Facebook'south database could lucifer them to his Facebook profile and serve targeted ads. Separately, some people complained this year that the social network allowed them to look up a person's Facebook profile just past typing a telephone number into its search bar.

The company has removed the ability to detect people'south profiles by entering their phone number, said Rochelle Nadhiri, a Facebook spokeswoman. She added that when a user ready two-step verification with a phone number, the visitor would not use the information to serve targeted ads.

But when large companies like Facebook abuse your digits, whom do you trust?

Unfortunately, in that location is no bully solution. Information technology all involves work.

That includes first request yourself whether the benefits of giving out your phone number outweigh the potential risks.

Yous might as well want to fix a second phone number to cloak your personal digits altogether. You lot could share this 2nd telephone number with people and brands you don't entirely trust. Apps like Google Vox and Burner let y'all create a different number that you can employ for calls and texts.

As for two-gene authentication, about tech companies offer other verification options. They include apps that generate temporary security codes or a physical security key that can be plugged in. Generally, those are safer to employ than a telephone number.

Hither's a bonus piece of advice. If y'all have business organization cards with your personal number printed on them, shred them and lodge new ones with just your office line.

Eventually, I spoke to Mr. Tezisci virtually his experience tracking me. He said he was surprised by how hands a person could be targeted with a unmarried set of numbers.

"I but spent an hour, and I was able to see all your addresses and all telephone numbers," he told me. "I think that'southward scary, isn't information technology? And I selected the legal options. If I were a scammer, I would have gone for your relatives."