Partial phone numbers leaked: what it means and what to do

Risk level: low. Can you change it: yes. Found in 2 breaches in this directory.

What this data is

Part of a phone number, often the last two to four digits shown in account recovery screens, or a number with some digits masked.

The risk on its own

A few digits are low risk and cannot receive a call or a text. Their main use is confirmation: they show an attacker which number protects the account. Account recovery pages already show similar masked numbers, so the leak adds limited new information.

The risk combined with other data

With your name and address, a partial number can often be matched to the full one using a people search site or another leak. That confirms which number receives your security codes, making you a candidate for a SIM swap. It also makes a scam call or text saying we sent a code to your number ending in these digits sound real.

How criminals use it

  • An attacker matches the last digits to a full number from a people search site and targets it for a SIM swap.
  • A scam text says a code was sent to your number ending in the right digits and asks you to forward it.
  • A caller quotes the partial number to a support desk to show they know the account's recovery details.

What to do now

  1. Set a port out lock or transfer PIN with your mobile carrier.
  2. Move important accounts from SMS codes to an authenticator app or passkey so the phone number stops being the key.
  3. Remove your full phone number from people search sites so partial digits cannot be matched.
  4. Never forward or read out a code you did not request, whatever digits the message quotes.

Frequently asked questions

Can someone text me with only part of my number?

No. They would need the full number, which is why the real risk is matching the digits to your number from another source.

Why do sites show part of my number anyway?

Recovery screens show a few digits so you can recognise which phone will get the code. A leak makes those digits available beside your name.

Should I change my phone number?

Not for a partial leak. Lock your SIM, move accounts off SMS codes and remove your full number from people search sites instead.

Breaches that exposed this data

  • Gemini: 2022-12-13, 5.3M accounts, Email addresses, Partial phone numbers
  • CoinTracker: 2022-12-01, 1.6M accounts, Email addresses, Partial phone numbers

Tools that help

Related guides

Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.