What to Do If Your Phone Number Was in a Data Breach

You cannot un-leak a phone number, but you can make it much less useful to a scammer. Start with your mobile account.

By Siddharth ShankarUpdated October 11, 2026

Unlike a password, a phone number is hard to change. Many people have used the same number for years, and banks, apps and friends all rely on it. When a breach lists your number, the realistic goal is not to hide it again but to reduce the damage it can do.

For background on what an exposed number reveals, read what does an exposed phone number mean. This guide is about the actions to take after a breach.

What the risk actually is

A leaked number mainly causes three things: more scam calls and texts, phishing messages that use your name and, in some cases, SIM swapping. The FTC explains the last one: a scammer contacts your carrier, claims your phone was lost or damaged and gets a SIM card tied to your number activated on their device. They then receive your calls and texts and can use verification codes to take over accounts.

1. Add a PIN or password to your mobile account

The FTC advises setting up a PIN or password on your cellular account. Call your carrier or use its app. This makes it harder for someone to persuade a representative to move your number to a new SIM.

2. Reduce reliance on SMS codes

If you are concerned about SIM swapping, the FTC suggests using an authentication app or a security key instead. Move your email, banking and any account that can reset others away from text-message codes first. Passkeys, where available, avoid codes altogether.

3. Be skeptical of unexpected contact

Expect calls and texts to rise. Do not reply to calls, emails or text messages that request personal information, which is the FTC's guidance for SIM swap prevention. See how scammers get your phone number and email and how to tell if a data breach notice is real or phishing.

4. Understand what the Do Not Call Registry does

The registry is aimed at unwanted sales calls from real companies that follow the law. The FTC says it does not block calls and will not stop calls from scammers making illegal calls. Registration never expires. Political, charitable, debt collection, informational and survey calls are exempt, as are companies with whom you have a recent business relationship. Add your number anyway to cut legitimate telemarketing, but do not expect it to stop scammers.

5. Check where your number is listed

Breach exposure is one source. Directories and people-search sites are another. Use how to check if your phone number is public and how to check where your phone number is listed online to find listings, then request removal using the site's process.

6. Tighten messaging privacy

Some messaging apps let others find you by phone number. Signal lets you control who can see your number and who can find you by it, and Telegram lets you hide your number from people who have not saved it. See who can see your phone number on WhatsApp, Telegram and Signal.

If you suspect a SIM swap

• Your phone suddenly loses service while others still have it.
• You receive notices about SIM or number changes you did not request.
• You are logged out of accounts or see verification codes you did not request.

If it happens, the FTC says to contact your provider immediately, change account passwords, review financial accounts and report fraud. If your Social Security number, card or bank numbers might be compromised, use IdentityTheft.gov. Our guide on what to do if your identity is stolen has the full sequence.