What can someone do with your phone number, and what they cannot

What a phone number on its own actually permits

Start with the narrow answer, because it is the one that is true without conditions. A number by itself is a way to reach you and a way to be displayed. That is most of it.

Messages designed to get something else out of you. The FTC’s description of what arrives is specific: “Scammers send fake text messages to trick you into giving them your personal information — things like your password, account number, or Social Security number.” It lists the usual stories: a promised prize or gift card, a low-interest credit card, help with student loans, a claim of suspicious account activity, a problem with your payment information, a fake invoice, a fake delivery notification. Its instruction is one line long: “If you get a text message you weren’t expecting and it asks you to give some personal or financial information, don’t click on any links.” And it adds the test that settles most cases: “Legitimate companies won’t ask for information about your account by text.”

Your number appearing on somebody else’s call. This is caller ID spoofing, and it is the reason people get angry callbacks about calls they never made. The FCC defines it as when “a caller deliberately falsifies the information transmitted to your caller ID display to disguise their identity”, and describes the variant built around your area code: “Robocallers use neighbor spoofing, which displays a phone number similar to your own on your caller ID, to increase the likelihood that you will answer the call.” Its advice if it happens to you is practical rather than technical — explain that your number is being spoofed, and consider putting a message on your voicemail saying so.

What the law prohibits is narrower than spoofing itself. The FCC: “Under the Truth in Caller ID Act, FCC rules prohibit anyone from transmitting misleading or inaccurate caller ID information with the intent to defraud, cause harm or wrongly obtain anything of value. Anyone who is illegally spoofing can face penalties of up to $10,000 for each violation.” But it also says plainly that “spoofing is not always illegal”, and gives the ordinary examples: a doctor calling from a personal mobile while displaying the surgery number, a business displaying its call-back number.

The one thing the number alone can unlock, and almost nobody has closed it

This is the part of the answer that is genuinely surprising, and it comes from the FCC rather than from anybody selling anything. Buried in its advice on spoofing is this: “If you have a voice mail account with your phone service, be sure to set a password for it. Some voicemail services are preset to allow access if you call in from your own phone number. A hacker could spoof your home phone number and gain access to your voice mail if you do not set a password.”

Read that sequence again, because it is the whole mechanism in two sentences. The voicemail box treats a call that displays your number as proof that it is you. Displaying your number is something anybody can do. So the number, on its own, opens the box — unless a password is set on it.

The fix takes a minute and costs nothing, and it is the only item on this page where the number by itself is the whole attack. Everything else needs something more.

What needs more than the number

The louder claims — your bank, your email, your identity — are real, but none of them follows from the number alone, and saying so is not reassurance: it is what tells you which switch to go and turn on.

Taking over the number itself. This is a SIM swap, and it needs a person at a carrier to be persuaded. CTIA, the United States wireless industry body, lists what is usually assembled first — “your email, home address, and your phone number” — and notes that “Often, this information is available online, either through a search engine or social media.” The FTC describes the call: “They may call your cell phone service provider and say your phone was lost or damaged.” The whole of that route, and the free lock that closes it at each carrier, is on the SIM swap page.

Getting into your accounts. This follows the number rather than accompanying it. The FTC: whoever controls your number “could log in to your accounts that use text messages as a form of multi-factor authentication”. Which is why its advice is to move the codes: “If you’re concerned about SIM card swapping, use an authentication app or a security key.” An account whose second factor is generated on your device is not reachable by anybody holding your number.

Opening things in your name. The FTC notes that somebody in control of your number “could open new cellular accounts in your name or buy new phones using your information” — and the words at the end of that sentence are doing the work. The number is one field on a form; the rest of the form is what makes it work, and reducing how much of that is findable is a separate job.

The four settings worth changing tonight

All four are free, all four are off until you turn them on, and each one removes a row from the table above.

1. The carrier’s line lock. Verizon calls it SIM Protection and says “At no cost to you, SIM Protection offers you the ability to lock lines on your account to prohibit changes to the SIM cards associated with those lines”. T-Mobile uses the same name for the SIM lock — “SIM Protection is a free feature offered to all T-Mobile Postpaid customers” — and keeps a second one for the number itself, Port Out Protection, which “adds additional security to your account by blocking unauthorized users from transferring your lines to another wireless carrier”. AT&T calls it Wireless Account Lock, “A free security feature” in its app which “disables specific transactions and account changes for all devices and lines”.

2. An account PIN. CTIA’s wording: “Establish a PIN on your account that is required for account access”, and “Use a unique number that cannot be easily determined” — not the last four of a Social Security number, not a date of birth, not an anniversary. The FTC says the same thing in one sentence: “Set up a PIN or password on your cellular account.”

3. A voicemail password. The FCC’s reason is above, and it is the only item here that closes something the number alone can reach.

4. Two-factor codes off text messages. The FTC’s wording again: “text message verification may not stop a SIM card swap”. Moving the important accounts — email first, then the bank — to an app or a key is the change that makes the whole rest of this page irrelevant to you. If the difference between the two kinds of second factor is not obvious, it is worth ten minutes.

Reporting the messages, and what reporting actually does

There is a free route for the texts, and it is short. The FTC’s instruction is to copy the message and forward it to 7726, which spells SPAM on a keypad, and to report it in the messaging app as well. Its stated reason for the first: it “helps your wireless provider spot and block similar messages in the future”.

The FTC also asks people to report the scam itself at ReportFraud.ftc.gov, and its advice for the calls is the FCC’s: do not answer numbers you do not recognise, and if you do answer and a recording invites you to press a button to stop the calls, hang up instead — the FCC states that “Scammers often use this trick to identify potential targets.”

Replying “STOP” to a message you did not sign up for does the same thing that pressing the button does: it confirms the number is live and read by a person.