Your phone number is a password you can't change

It was built to route calls. We turned it into the key to everything.

If one of your passwords leaks, you change it. It is annoying, and then it is over.

Now think about your phone number. It sits on your bank account, your email recovery page, your messaging apps, your food delivery account and the form you filled in at the dentist. If it ends up in the wrong hands, you can't really change it. Too many people and too many services know you by it.

That makes a phone number an odd thing: it is used like a secret, shared like an address, and nearly as permanent as a name.

Three jobs it was never designed for

A phone number was made to do one thing: tell the network where to send a call. Over the years we gave it three more jobs.

1. Proof that you are you. "We sent a code to your phone." The idea is that only you hold the phone with that number. Often that is true. But the number isn't tied to your device; it is tied to an account at a carrier, and carriers can move it. In a SIM-swap attack, someone convinces the carrier to move your number to their SIM. From then on, the codes arrive on their phone. This is one reason security guidance, including NIST's digital identity guidelines in the US, treats codes sent by SMS as a weaker option than an authenticator app or a hardware key.

2. Your username across services. Because nearly everyone has one, apps use the number as the thing that identifies you. That is convenient, and it also means the same identifier appears in many unrelated databases. When several of them leak, the number is the thread that ties the records together.

3. A way to find you. Many messengers ask to upload your contact list so they can show you who else is on the app. It works in both directions: anyone who has your number, including someone you would rather not hear from, can see that you are there.

And numbers get recycled

When you give up a number, the carrier eventually hands it to someone else. If an old account of yours still lists that number for recovery, the new owner may receive your codes. Most people never clean this up, because nobody remembers every place they typed a number in ten years ago.

What you can do today

None of this needs new tools.

What this doesn't solve

Being careful with your number doesn't remove it from the places that already have it. And some services simply won't let you sign up without one. You can reduce how much rests on the number; you can't get to zero.

Where LILAC fits

I build LILAC, a messenger that has no phone number field at all. You connect with someone by showing a QR code or sending an invite link, and you can take that link back later. There is no contact upload, so nobody finds you because they happen to have your number.

It does not fix the list above. Your bank will still want your number. But for the many conversations where a number is far more than the other person needs, a link you can cancel is enough.

This is part of "Nothing to Leak", a series of plain-language notes on security. Corrections are welcome: [email protected].