The Serious Risks of Phone Number Exposure
Your phone number is a critically important piece of personal information in modern society. It is widely used for bank identity verification, SNS authentication, and logging into various services. If your number leaks, you face risks ranging from nuisance calls and caller ID spoofing fraud to identity theft and account takeovers. Mobile numbers starting with 090, 080, or 070 are especially high-value targets because they are used for SMS authentication and account recovery.
Japan's Personal Information Protection Commission handled 7,075 breach reports in fiscal 2023, up from 4,217 the year before - an increase of more than 1.6 times. Once leaked, a phone number can be traded on the dark web and shared among multiple criminal groups.
How Phone Numbers Get Leaked
Registering for Web Services
When you enter your phone number for membership registration or campaign entries, it is stored in the service's database. If the provider's security is inadequate, your number may be exposed through unauthorized access. Some privacy policies also permit sharing your number with advertisers or marketing firms.
Small-scale services and overseas platforms pose the highest risk. While data breaches occur even at major companies, smaller services often lack proper encryption and access controls, making them attractive targets for attackers.
SNS Exposure and Contact Syncing
Listing your phone number on SNS profiles or enabling contact sync features can inadvertently expose your number. Past incidents have seen hundreds of millions of phone numbers leaked from major social platforms. If phone number search is enabled, anyone who knows your number can find your account.
Data Brokers and List Dealers
Phone numbers leaked from corporate databases are bought and sold through data brokers. Once listed, your information may be resold among multiple dealers and added to spam call and SMS target lists.
Phishing Attacks
Phishing scams that trick you into entering your phone number on fake login pages or registration forms are a major leak vector. The typical pattern is tapping a link in a fraudulent SMS and entering your phone number or password on the page it opens.
Collection from Public Sources
Company websites, job postings, real estate listings, and flea market app messages can inadvertently expose phone numbers. Automated scraping tools are also used to harvest numbers in bulk.
Practical Steps to Prevent Number Leaks
Adopt the following practices to minimize the risk of your phone number being exposed:
- Unregister from unused services: Delete accounts for services you no longer use and request that your phone number be removed from their databases.
- Use a secondary line: Keep a separate 050 number (IP phone) or budget SIM for web service registrations and flea market transactions.
- Switch two-factor authentication from SMS to an authenticator app: SMS authentication is vulnerable to SIM swap attacks. Migrating to Google Authenticator or Microsoft Authenticator reduces the risk even if your number is leaked.
- Disable phone number search on SNS: In each SNS's settings, change "Who can find me by phone number" to "Only me" and turn off contact syncing.
- Check privacy policies: Before registering for a new service, verify how your phone number will be used and whether it will be shared with third parties.
- Minimize phone number input: Skip the phone number field when it is optional. When required, consider using your secondary line.
SNS Privacy Settings Guide
Menu names and their locations change as these apps are updated, so treat the paths below as a guide to where to look. If you cannot find a setting, search each service's help pages for "phone number."
In the privacy section of Settings, set "Who can look me up using my phone number" to "Only me" and disable the contact upload feature. Leaving phone number lookup enabled means anyone who knows your number can identify your account.
Turn off contact syncing and delete any contacts you have already synced. Removing your phone number from the contact details shown on your profile also weakens the link between the number and your account.
X (formerly Twitter)
Go to Settings and Privacy > Privacy and Safety > Discoverability and Contacts, and turn off both "Let others find you by your email address" and "Let others find you by your phone number."
LINE
Go to Settings > Friends > "Allow others to add you" and turn it off. This prevents people who know your number from automatically adding you as a friend. Also disable "Auto-add friends."
Defending Against SIM Swap Attacks
A SIM swap attack occurs when an attacker impersonates you to your carrier and requests a SIM card reissue. Once the new SIM is inserted into the attacker's device, all SMS messages - including authentication codes - are redirected to them.
SIM Swap Countermeasures
- Harden identity checks on your carrier account: Choose an account PIN that is hard to guess and enable any additional verification your carrier offers, so a SIM reissue cannot go through on a single request.
- Migrate from SMS to authenticator apps: Switch two-factor authentication for banks, SNS, and email to an authenticator app.
- Be wary of suspicious carrier contacts: Messages claiming "Your SIM card needs to be replaced" may be fraudulent.
- Watch for sudden loss of signal: If your phone unexpectedly shows no service, a SIM swap may have been executed. Contact your carrier immediately.
What to Do If Your Number Has Been Leaked
If Spam Calls Suddenly Increase
A sudden spike in spam calls or SMS may indicate your number has been leaked. Install a spam call filter app and configure it to auto-block suspicious numbers. Then review which services use your number for SMS authentication and begin migrating to authenticator apps.
Change Your Passwords
If your number has been leaked, change the passwords for all associated accounts. Prioritize services that use your phone number as a login ID or for SMS authentication.
Consider Changing Your Number
If spam calls become unmanageable, contact your carrier to discuss changing your number. When you do, remember to update your number with all financial institutions, government agencies, and two-factor authentication settings.
Preparing for Corporate Data Breaches
No matter how careful you are, the services you use may suffer data breaches. Breach-lookup services such as Have I Been Pwned let you enter an email address and see whether it appears in known breaches. Check the address you use for service registrations periodically, so you notice when a company that holds your phone number has been breached. Familiarize yourself with what to do when your number is exposed in a data breach. If a company notifies you of a breach, promptly change your passwords and review your authentication settings.
Under Japan's Personal Information Protection Act, a company must report to the Personal Information Protection Commission and notify the individuals concerned when a breach is likely to seriously harm their rights or interests - for example a leak of credit card numbers or sensitive personal information, or a leak caused by unauthorized access. When you receive such a notification, confirm the scope of the leaked information and take appropriate action. If credit card numbers were included, contact your card issuer to request a replacement.
Summary - Number Management Is Information Security 101
Protecting your phone number is a fundamental skill for living safely in the digital age. By consistently applying measures like using secondary lines, unregistering from unused services, and reviewing SNS privacy settings, you can significantly reduce the risk of number leaks. Even if a leak occurs, swift action can minimize the damage.