Phone Number Leaked? Why It’s Worse Than a Leaked Email

A leaked email gets you spam. A leaked phone number gets you phone calls from people who already know your name.

That’s the short answer. Your number is harder to change than an email, it reaches you directly, and a lot of your accounts use it to prove you’re you.

And it’s leaking more than ever. Of the breaches dated 2026 in our catalog, nearly three in four exposed phone numbers.

Only one in ten exposed a password. Count the records and the gap gets wider: nearly 258 million phone-number records from this year’s breaches, against nearly 26 million password records.

Quick context if you’re new here. I run XposedOrNot, a free, open-source breach checker.

You type in an email address, and it shows you which public breaches it appears in and what each one exposed. Phone numbers included.

The numbers below come from our catalog of 785 breaches, pulled on 28 September 2026. The outside numbers come from the FTC, the FBI, NIST and peer-reviewed security research, with links at the end.

The short version

• 277 of the 785 breaches we index exposed phone numbers. In 2026 it’s 58 of 78.
• Phone scams cost more than email scams. The FTC’s median loss was $1,500 for a scam that started with a call, against $600 for one that started with an email (2024).
• Most breaches with your number had no password in them. So “change your password” doesn’t fix anything here.

How often do phone numbers leak?

More often every year. This is our catalog, grouped by when each breach happened:

Breach dated	Breaches	Exposed phone numbers	Exposed passwords
2019 and earlier	398	15%	85%
2020 to 2022	188	43%	69%
2023 to 2025	121	61%	30%
2026	78	74%	11%

Look at the two columns moving in opposite directions. Passwords are leaving the files. Phone numbers are moving in.

Why? From what we’ve seen, a lot of recent breaches are customer records pulled from shops, delivery firms and support desks. Those files hold your contact details, not your login.

(Records, not people, by the way. One person can sit in many breaches, so none of these totals is a headcount.)

What does this mean for you? If a recent breach notice lands in your inbox, the question isn’t only “was my password in it?” It’s “was my number in it?”

You can see that on XposedOrNot. Check your email and every breach in the result lists its data classes, including “Phone numbers” when they leaked.

What leaks along with your number?

Almost never just the number. Of the 277 breaches with phone numbers in our catalog:

Also in the same breach	Breaches	Share
Your name	248	89%
Your home address	186	67%
Your password	104	37%
Your date of birth	97	35%

Name plus number is the dangerous pair, because it lets a stranger call you and sound like someone who knows you.

And 173 of those 277 breaches carried no password at all. So a password reset does nothing for you there.

That’s why I keep saying: read the data classes, not just the breach names. Our guide to checking your email walks through what each result means.

Why is a leaked phone number worse than a leaked email?

Four reasons. Each one has research behind it.

1. You can’t swap it like an email

Changing an email takes two minutes.

You make a new one, or an alias, and move on.

Hardly anyone changes their phone number. Your bank, your family, your doctor and your delivery apps all have it.

Researchers tested this at NDSS 2026, one of the big security conferences. They took the phone numbers from the 2021 Facebook leak (488 million of them) and checked which were still active on WhatsApp.

58% (281 million of the 488 million) were still active in the team’s scan.

Years later, most of those numbers still worked.

So a leak from 2021 can still reach you today.

That’s why an alert for new breaches matters more for your number than for almost anything else.

XposedOrNot sends one by email when your address shows up in a new breach. It’s free, and it’s how you’d learn that a new file holds your number too.

2. Scams by phone cost more than scams by email

This is the part that surprised me.

The FTC’s 2024 data book breaks down fraud reports by how the scam first reached people.

Scam started by	Reports	Total lost	Median loss
Phone call	284,659	$948 million	$1,500
Text message	246,784	$470 million	$1,000
Email	371,651	$502 million	$600

Email scams were the most common. But phone calls had the highest median loss per report of any contact method in the FTC’s table.

And 19% of phone-call reports came with money lost, against 11% for email. Calls work better on people, sadly.

The FBI tracks phone-led fraud too. Its 2025 report counted more than 80,000 complaints about fake tech support and fake government callers, with losses over $2.9 billion.

Caller ID proves nothing either. A USENIX Security 2019 study made test scam calls to 3,000 university staff and students, 300 per version.

When the call showed a spoofed caller ID with a familiar name, 10.33% of that group (31 of 300) were possibly tricked.

So when a caller knows your name, where you live and which shop you ordered from, that proves nothing. It’s in the files.

Checking which of your breaches exposed your number and address tells you exactly what a scammer could quote back at you. That’s worth knowing before the call, not after.

3. Your number is a key to your accounts

A lot of sites send login codes by text. Some let you reset your password with nothing but a text.

That makes your number a target.

The attack is called SIM swapping: someone talks your mobile carrier into moving your number onto their SIM card.

Princeton researchers tried it themselves in 2019, on prepaid accounts at five US carriers. 39 of 50 attempts worked.

At the three big carriers back then, every single attempt worked. They also found 17 websites where a SIM swap alone, with no password, was enough to take over an account.

A 2023 study at ACM CCS looked at 559 websites that use SMS codes. 199 of them (35.6%) let you get back in by contacting support, which is one more door a good talker can open.

The official advice has caught up.

NIST now labels phone-based codes a “restricted” way to log in. CISA’s guidance for high-risk people says it plainly: “Do not use SMS as a second factor for authentication.”

The FBI counted 971 SIM-swap complaints in 2025, with $17.4 million lost. That’s down from 2023 ($48.8 million), and I’m glad, but it only takes one.

This is where your number and your email meet. If a breach leaked both, and your email account still resets by text, one SIM swap can open everything.

My earlier post on what leaks that’s worse than a password covers the carrier PIN and the other quick fixes. The steps below go further.

4. Your number is a lookup key for strangers

Anyone can save a phone number in a messaging app and see whether it has an account, often with a profile photo and name attached. That’s how “contact discovery” works.

At NDSS 2021, researchers used it to query 10% of all US mobile numbers on WhatsApp, and all of them on Signal. The NDSS 2026 team went further: over a hundred million numbers an hour, with no real blocking.

So a leaked number doesn’t just sit in a file. It can get matched to your photo, your name and your apps.

Then come the texts.

A 2024 IEEE study of public SMS gateways found 67,991 phishing messages, grouped into more than 600 separate scam operations.

In the UK, Ofcom says 40% of mobile users got at least one suspicious text in the three months before its early-2026 survey. People forwarded more than 100 million of them to the 7726 reporting number in the year to March 2025.

That’s the same reason we’ll never let anyone search XposedOrNot by phone number. More on that just below.

And one more: numbers get recycled

When you give up a number, your carrier eventually hands it to someone else, and that’s where it gets messy.

A Princeton study sampled 259 recycled numbers. 171 of them were still tied to accounts at popular websites, and 100 were linked to leaked logins online.

Nearly 10% of the numbers they monitored were still getting sensitive messages meant for the old owner.

So if you change your number, move your accounts off the old one first, or the next person gets your codes.

Can XposedOrNot check my phone number?

No, and that’s on purpose.

We don’t let anyone search by phone number or by name. If we did, anyone could look you up with just your number, which is the exact problem this post is about.

What we do: you check your email, and each breach shows whether it also leaked phone numbers. You get the answer without us building a phone-number lookup that strangers could abuse.

And if you’d rather your email stopped showing up in anyone’s breach search, Privacy Shield hides it from public lookups on our side. It doesn’t pull anything back from the breach files (nothing can), but it’s one less place to find you.

What should you do if your phone number leaked?

In this order. Most of it takes an evening.

1. Check your email on XposedOrNot and look for “Phone numbers” in the data classes. Now you know which breaches have it.
2. Lock your number at your carrier. The FTC’s advice: “Set up a PIN or password on your cellular account.” Ask what stops a SIM swap, and switch it on.
3. Move your important logins off text codes. Start with your main email and your bank. Use an authenticator app or a passkey. The FTC says the same: “use an authentication app or a security key.”
4. Take your number off as a recovery option where the site lets you. Where it won’t, add a second check that only you have.
5. Switch on two-step verification in your messaging apps. WhatsApp and Signal both have it. The UK’s NCSC suggests it too, since attackers like tricking people into handing over login or recovery codes.
6. Treat callers and texts that know your details as unverified. Hang up and call back on the number from the official website.
7. Report scam texts. In the US and the UK, forward them to 7726 (SPAM). Your carrier can block the sender.
8. Get alerts for new breaches, so the next leak doesn’t take you by surprise.

In the US, the FCC adopted rules in November 2023 that require carriers to check who you are before moving your number, and to tell you when someone asks. The start date for those rules has been pushed back, so ask your carrier what it already does to stop an unauthorised port-out.

If you run IT for a company

Your staff’s work numbers leak too. And a caller who knows an employee’s name, number and manager is exactly how help-desk scams start.

Two free things help. Domain monitoring tells you when addresses on your company domain turn up in a new breach, including the ones that also leaked phone numbers.

And for the people most likely to be targeted by name, VIP monitoring watches your executives’ exposure separately.

If you look after other companies’ domains, as an MSSP or IT provider, that’s what xonThreatIntel+ is for.

The caveats

• Our catalog holds public breaches we’ve indexed, not every breach that ever happened.
• “Phone numbers” is our label, assigned per breach from what the files and the reporting show. It doesn’t mean every record in that breach had a number.
• The year trend is our catalog sorted by breach date. Read the percentages as a direction, not a law. Percentages are rounded down.
• The FTC figures are what people reported to the FTC, not all fraud. Most people never report.
• The FBI’s SIM-swap losses actually fell between 2023 and 2025, and I’ve left that in.
• Records, not people.

FAQ

Is it dangerous if my phone number was leaked?

Yes, more than a leaked email, mostly because you can’t just swap it out. Scammers can ring or text you directly, often using your real name, and in the FTC’s 2024 numbers a scam that started with a call cost people a median $1,500 (for email it was $600). And there’s the SIM swap, where your number gets moved to someone else’s phone (and your login codes with it).

Can I check if my phone number was in a data breach?

You check your email address on XposedOrNot, and each breach in the result tells you if phone numbers leaked too. We don’t do phone-number search, on purpose (it would let strangers look you up). We count 277 breaches with phone numbers in them, out of 785 (September 2026).

What should I do if my phone number was leaked?

Honestly, the carrier call comes first: ask them for a PIN or a port-out lock. Next, get your email and your bank off text codes, and switch on two-step verification in WhatsApp too. And from here on, don’t believe a caller just because they know things about you; scam texts go to 7726.

Can someone hack my accounts with just my phone number?

Not with the number alone, but it’s a big head start. If they can talk your carrier into a SIM swap, they receive your text codes, and some sites let them reset a password with that code alone. A Princeton study (published 2020) found 17 websites where a SIM swap alone, with no password, was enough.

Appendix: Sources and references

• XposedOrNot catalog figures (785 breaches, 277 with phone numbers, year buckets, what leaks alongside): api.xposedornot.com/v1/breaches, pulled 28 September 2026. Anyone can pull the same fields (exposedData, breachedDate) from the open endpoint.
• FTC contact-method table (reports, losses, median loss, share of reports with a loss): Consumer Sentinel Network Data Book 2024, Federal Trade Commission, March 2025, p. 12.
• FTC advice on SIM swaps (carrier PIN, authentication app or security key): SIM swap scams: how to protect yourself, October 2019.
• Forwarding scam texts to 7726: FTC, How to recognize and report spam text messages; NCSC, Reporting a scam text message.
• SIM-swap complaints (971, $17,366,758 in 2025; $48,798,103 in 2023) and call-centre fraud (more than 80,000 complaints, over $2.9 billion): FBI IC3 2025 Internet Crime Report, April 2026.
• Phone codes as a “restricted” authenticator: NIST SP 800-63B-4, sections 3.1.3.3 and 3.2.9, July 2025.
• “Do not use SMS as a second factor for authentication”: CISA, Mobile Communications Best Practice Guidance, December 2024.
• FCC SIM-swap and port-out rules: FCC news release and Report and Order FCC 23-95, November 2023.
• WhatsApp two-step verification and code-sharing scams: NCSC, NCSC warns of messaging app targeting, March 2026.
• UK suspicious texts (40% in three months; over 100 million 7726 reports): Ofcom, Combatting mobile messaging scams, statement, July 2026, paras 3.20 to 3.21.
• 58% of 488 million leaked numbers still active on WhatsApp; over 100 million numbers probed per hour: Gegenhuber, Frenzel, Günther, Ullrich and Judmayer, “Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy”, NDSS Symposium 2026.
• Contact discovery at scale (10% of US numbers on WhatsApp, 100% on Signal): Hagen, Weinert, Sendner, Dmitrienko and Schneider, “All the Numbers are US: Large-scale Abuse of Contact Discovery in Mobile Messengers”, NDSS Symposium 2021.
• 39 of 50 SIM swaps succeeded; 17 websites open to a SIM swap alone: Lee, Kaiser, Mayer and Narayanan, “An Empirical Study of Wireless Carrier Authentication for SIM Swaps”, USENIX SOUPS 2020.
• Recycled numbers (171 of 259 tied to accounts, 100 of 259 linked to leaked logins, nearly 10% still receiving sensitive messages): Lee and Narayanan, “Security and Privacy Risks of Number Recycling at Mobile Carriers in the United States”, APWG eCrime 2021.
• 67,991 SMS phishing messages, 35,128 campaigns, over 600 operations: Nahapetyan, Prasad, Childs, Oest, Ladwig, Kapravelos and Reaves, “On SMS Phishing Tactics and Infrastructure”, IEEE Symposium on Security and Privacy 2024.
• Spoofed caller ID, 10.33% possibly tricked (31 of 300), 3,000 participants: Tu, Doupé, Zhao and Ahn, “Users Really Do Answer Telephone Scams”, USENIX Security 2019.
• 199 of 559 SMS-using websites (35.6%) offer support contact as a recovery route: Amft, Höltervennhoff, Huaman, Krause, Simko, Acar and Fahl, “We’ve Disabled MFA for You: An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments”, ACM CCS 2023 (doi:10.1145/3576915.3623180).
• Related on this blog: 5 things in a data breach worse than a leaked password; how to check if your email was in a data breach; Privacy Shield; VIP monitoring for executives; how to avoid account takeover.

If this helped, a star on GitHub helps other people find the project. Honestly, it makes our day.

—