How to tell if your phone number has leaked (and what to do)

Your mobile number is known to your family, your work and little else. So why do strangers call every week, why do you get texts about prize draws you never entered, and why does a blackmailer know your name and email? The most likely answer is that your number has leaked: it is circulating in some database you do not control. Here is how to check, and above all what to do next, because a leak cannot be undone but its consequences can be contained.

How does my number end up in strangers' hands?

It is almost never because your phone got "hacked". The usual routes are far more mundane:

• Breaches at big platforms. Social networks, online shops, ride-hailing or food apps: when one of them suffers a breach, your name, email and phone go out in a bundle that gets sold and resold for years. If you have been online for over a decade, it is odd not to be in any.
• Forms and prize draws. Every time you leave your number in a draw, a plan comparison, a "market survey" or the mall's free wifi, that detail enters a commercial database that can be sold (legally or not) to third parties.
• Synced address books. Many apps upload your contacts to their servers. Your number circulates not only because of what you do, but because of what your contacts do with the apps they install.
• Directories and data brokers. There are companies whose business is crossing public and commercial data and selling profiles. Your number, tied to your name and city, is standard merchandise.
• The call you answered. Auto-diallers verify live lines by calling and hanging up: if you pick up, your number gets flagged as "active and with a human", which is worth more. It is the phenomenon we explain in they call me and say nothing.

Understanding this matters for one reason: the fix is not changing your number every year (the new one will leak just the same), but reducing where you hand it out and securing what depends on it.

How do I check whether my number has leaked?

There is no single green/red light, but there are several useful checks:

1. Search your own number in quotes in a search engine ("+1 555-123-4567"). If it shows up on report sites, forums or dodgy directories, it is circulating publicly. Do the same with your email.
2. Check breach-lookup services with your email (the one tied to your accounts). If your email appears in known breaches, assume the phone number attached to it is circulating too.
3. Review what your callers know about you. If a stranger calls you by your full name, or a text mentions real details about you, that is no coincidence: they are working from a leaked database. Look that number up in the spam numbers directory: if it accumulates reports of mass campaigns, it confirms your details are in circulation.
4. Look at your accounts. "Sign-in from a new device" alerts you do not recognise, password-reset emails you did not request, or contacts receiving spam "from you" are signs your details (and possibly your credentials) are compromised.
5. Check your apps' permissions. Review which apps have access to your contacts and phone, and remove access from those that do not need it. Every synced address book is a future leak.

My number is leaked, what do I do now?

Assume you will never "un-leak" it: once a detail circulates, it cannot be taken back. The goal is to make it useful for as little as possible:

1. Lock down authentication. Your leaked number + your leaked email = attempts to break into your accounts. Change your important passwords (start with email), turn on two-step verification for everything sensitive and, where you can, use an authenticator app instead of SMS: SMS to a leaked number is the weak link.
2. Do not confirm details to strangers. Someone calling with partial details about you ("is this Mr...?") wants you to fill in the rest. Do not confirm name, ID or address to whoever calls. Hang up and verify on your own.
3. Shrink the surface. Join a do-not-call list such as the TPS (UK) or the National Do Not Call Registry (US) for legal commercial spam, ask companies that bother you to delete your data, and stop giving your real number in forms: use a second number or an alternative contact for draws, comparators and throwaway signups.
4. Filter on the phone. Turn on unknown-call filtering on iPhone or Android, block repeat numbers and do not call back numbers you do not recognise.
5. Watch your bills and accounts. Review statements and bills every month for activity you do not recognise, and pay attention to porting or verification texts you did not request: they could signal an attempted fraudulent SIM swap or unauthorised signup.
6. Report. Every spam number you report in the spam numbers directory helps the next person recognise it before engaging.

If you also suspect your details were used to sign up for something in your name, there is the complaint route we explain in how to recover money from a phone scam.

Frequently asked questions

Should I change my number? Only in extreme cases (persistent harassment). For ordinary spam it is not worth it: the new number will end up in the same databases as soon as you use it the same way. Better to lock down accounts and filter calls.

Can I ask for my number to be deleted from those databases? From identifiable companies, yes: you have erasure and objection rights. From the illegal databases circulating on scammer forums and channels, there is nobody to ask. That is why the strategy is containment, not deletion.

Is giving my number in a form always a bad idea? No, but be selective: necessary for your bank or doctor, dispensable for a draw or free wifi. Read what they want it for and whether they will share it with third parties; if it is not clear, do not give it.

Do apps that "identify who's calling" help or make it worse? They help identify spam, but many work by uploading your address book to their servers — that is, by leaking your contacts' numbers. If you use one, check its privacy policy and settings before giving it access to your contacts.

In short

Your number is almost certainly already circulating in some database you do not control, and that cannot be fixed. Everything else can: unique passwords with two factors, zero detail confirmations to strangers, a do-not-call list, filtering on the phone and monthly bill checks. And when you get a call from a number you do not know, it takes seconds to look it up in the NoCall spam numbers directory: knowing others already reported it is the fastest way to decide not to pick up.