Should You Change Your Phone Number if a Scammer Has It? An Expert‘s Perspective

Your phone number is one of your most important and sensitive pieces of personal information. In the wrong hands, it can enable identity theft, stalking, harassment, and an unending stream of scam calls and texts. According to the FTC, phone scams cost victims a staggering $1.2 billion in 2021 alone, up from $963 million in 2020 [^1].

So if a scammer gets ahold of your number, should you change it? As a cyber security expert with over a decade of experience focused on cloud data protection, here is my perspective.

The Growing Threat of Phone Number Scams

First, it‘s important to understand the severity and scale of this threat. With your phone number, a scammer can:

• Impersonate you to steal your identity or accounts
• Trick your friends and family with scams
• Sign you up for expensive premium text services
• Stalk and harass you with endless calls and messages
• Try to scam you directly via phishing
• Correlate your number with other stolen data on the dark web for more effective identity theft

Phone numbers have become the skeleton key to consumers‘ entire digital lives. "Your phone number is how you‘re identified across numerous websites and apps, so it‘s really scary in terms of the access it grants scammers," says Kathy Stokes, director of fraud prevention at AARP [^2].

The latest scheme, known as "SIM swapping" or "port-out scams," is particularly dangerous. Hackers convince your carrier to port your number to their own SIM card, instantly redirecting your texts and calls to them. They then use your number to bypass two-factor authentication and break into your accounts.

According to the FBI‘s Internet Crime Report, the number of reported SIM swapping incidents nearly doubled from 2020 to 2021, while associated losses jumped from $12 million to $68 million [^3]. Javelin Strategy found that account takeover fraud from SIM swaps spiked 72% in 2021 [^4].

"SIM swaps have been used to steal millions in cryptocurrency, take over social media accounts, and completely upend people‘s digital lives," says Phil Muncaster, guest writer at MIT Technology Review [^5]. Ironically, the growth of SMS-based multi-factor authentication has made phone numbers even more valuable to hackers.

Immediate Steps to Take if Your Number is Stolen

If you know or suspect a scammer has compromised your number, take these steps immediately to mitigate the damage:

1. Report it to your carrier‘s fraud department. They can block further porting attempts and help you monitor for suspicious activity. Ask them to set a port validation password for your account.

2. Change passwords on all accounts linked to that number, especially those using it for two-factor authentication or account recovery.

3. Switch two-factor authentication from SMS to a secure authenticator app like Authy or Google Authenticator everywhere you can.

4. Alert your contacts not to trust any requests coming from your number until further notice, as they may be scams.

5. Block the scammer‘s number if you‘re able to identify it. Most carriers and smartphones offer spam blocking services.

6. Consider signing up for identity theft monitoring to watch for signs of your number being used to open new accounts in your name.

Should You Actually Change Your Number?

So when does it make sense to go nuclear and have your carrier change your number entirely? It‘s a tricky decision with major pros and cons.

On the plus side, changing your number immediately cuts off the scammer‘s access. They can no longer impersonate you, and any stalking or harassment linked to the old number will stop. It‘s the fastest way to halt the bleeding.

However, changing your number is a massive inconvenience that can create almost as many problems as it solves:

• You have to update your number with every single person and entity that has it: friends, family, employers, businesses, doctors, schools, apps, loyalty programs, and more. Forget even one critical account and you could lose access to it completely.

• Some services, especially financial institutions, make you jump through hoops to change the number on your account as an anti-fraud measure. It can take weeks of back-and-forth to complete the process.

• There‘s a good chance scammers already used your number to register accounts or conduct scams. "Victims then have to contact each platform individually to regain access and shut down impostor accounts, a complicated effort that can take months," says Muncaster.

• Any texts or calls sent to your old number may disappear into the void, including important notifications you forgot to update. An innocent stranger who gets reassigned your old number may end up receiving sensitive messages meant for you.

• After all that effort, there‘s no guarantee your new number will stay safe. Scammers are endlessly inventive at tricking victims into revealing personal data.

Rebecca Moody, head of data science at Comparitech, says number changes only make sense for extreme cases. "If you‘re being persistently harassed or scammed in a way that blocks and reports aren‘t stopping, and it‘s causing you major distress, then it may be worth the hassle of changing your number. But for a one-off scam attempt, it‘s probably overkill [^6]."

Indeed, a Princeton study found that the average recycled phone number gets hit with scam attempts within the first week of activation [^7]. Truly determined attackers may even be able to link your new number to the old one.

How to Actually Change Your Number

If you decide changing your number is the best path forward, contact your carrier‘s customer support line or visit a store:

• Verizon: Call 800-922-0204 or log into your My Verizon account online. The first change is free; additional changes are $15 each.
• AT&T: Call 611 from an AT&T phone or 800-331-0500. Changing your number is free within the first 30 days of an account update, then $36 per change after that.
• T-Mobile: Call 611 from a T-Mobile phone, 877-746-0909 from any phone, or make the change from your T-Mobile account online. The first change is free; subsequent ones are $15 each.

Before calling, make a comprehensive list of every person, institution, and online account that needs your new number so you can update them efficiently. Prioritize the most sensitive accounts first: email, banking, social media, healthcare, government benefits, etc.

Don‘t forget to tell friends, family, employers, businesses, subscription services, loyalty programs, alumni associations, and anywhere else that may try to contact you via phone or use your number to verify your identity. Keep your old number active for at least a week to avoid missing any important calls or texts during the transition.

The Hidden Costs of Changing Your Number

Even if you carefully follow these steps, changing your number can still have lasting negative consequences. In a hyper-connected world, a simple number change can disrupt your life and relationships in unforeseen ways:

• A survey by the nonprofit Identity Theft Resource Center found that 42% of consumers who changed numbers due to a compromise lost rewards points from loyalty programs, 39% couldn‘t migrate their in-app purchases to new accounts, and 36% could no longer receive texts from key friends and family [^8].

• The same survey found the average victim spent over 30 hours updating their information across an average of 26 different accounts. 14% spent more than 50 hours on cleanup.

• Withdrawing a number entirely makes it no longer reachable by former friends, colleagues, and acquaintances. It erodes your existing social and professional network; you may miss out on important opportunities simply because they have no way to find you.

• A significant percentage of consumers don‘t bother to update their number with vendors, institutions, and services they rarely use. The result is increased account churn, customer support costs, and lost revenue for companies.

• If scammers already maxed out multiple lines of credit in your name, changing your number won‘t undo that damage. You still have to go through the arduous dispute process to clear it up.

• For public figures, a long-held phone number can be part of their "brand." Abandoning it may require expensive updates to business cards, websites, advertising materials, and more.

"Changing your number due to fraud can feel like the ultimate walk of shame," says Eva Velasquez, CEO of the Identity Theft Resource Center [^9]. "It‘s an admission that you let your guard down and lost control over a core part of your identity."

Why It‘s So Hard to Stop Phone Number Hackers

So if phone number identity theft causes such extreme harm, why haven‘t carriers, regulators, and the security industry solved this problem? The answer lies in an unfortunate mix of financial incentives, outdated infrastructure, legal loopholes, and consumer inconvenience.

It‘s important to remember that your phone number doesn‘t really belong to you – it belongs to your carrier. Federal law prohibits the sale of phone records, but numbers still get exposed through other means like data broker lists, phishing scams, and corporate data breaches.

"The carriers could implement much more robust security measures to prevent unauthorized porting, but they have little incentive to do so," says Jamie Williams, a cyber security fellow at the Electronic Frontier Foundation [^10]. "Fraudulent porting occurs on a massive scale because it‘s so lucrative for scammers and so cheap for carriers to allow."

Indeed, carriers‘ revenue isn‘t significantly impacted by SIM swaps and number hijacking. The FCC has fined carriers for related negligence in the past, but the penalties pale in comparison to their massive profits.

The telecom infrastructure for managing number ownership hasn‘t fundamentally evolved since its inception decades ago. Carriers still routinely grant porting requests with easily-forged documents like utility bills. As long as the underlying numbering systems remain insecure, determined scammers will find ways to exploit them.

Regulatory attempts to curb the problem remain piecemeal and ineffective. A federal anti-robocall law went into effect in 2021, but call spam and scams still hit record levels. The FCC now requires carriers to use number verification protocols, but implementation has been slow and inconsistent.

Perhaps most discouragingly, stronger anti-fraud measures can actually backfire by making it harder for legitimate consumers to conveniently manage their own accounts. "Every additional security hurdle we add to porting and account recovery just increases the chances of users getting unfairly locked out," says Moody.

Protecting Your Number Proactively

Ultimately, changing your number should be an absolute last resort after a breach. It‘s far better to prevent your number from being stolen in the first place. Once it‘s in scammers‘ hands, it‘s nearly impossible to fully contain the harm.

Carriers and regulators have proven ineffective at protecting consumers, so practicing good security hygiene is your best defense:

• Don‘t overshare your number. Treat it like your Social Security number; only provide it when absolutely necessary. Ask why it‘s required. If possible, use an alternate contact method.

• Remove your number from as many online accounts as you can, especially those you rarely use. Delete old accounts entirely and use "burner" numbers for new signups.

• Beware phishing attempts to trick you into revealing your number. Don‘t give it to unsolicited callers claiming to be from your bank, utility company, government agencies, etc.

• Use an authenticator app instead of SMS for two-factor authentication on all important accounts, including your email and your carrier account.

• Regularly check credit monitoring services for new accounts you don‘t recognize. Paid monitoring is best, but you can also get free reports from each bureau annually.

• Consider transferring your number to an online carrier that offers more advanced security features like hardware keys and geoblocking.

• Support proposed legislation to regulate data brokers and give consumers more control over how their information is shared.

It‘s tempting to view your phone number as a harmless piece of semi-public info, but that‘s exactly what makes it so valuable to scammers. "In today‘s era of nonstop breaches, everyone has to assume their data is already compromised. We can‘t get lazy about where we use and share our number," says Velasquez.

Scammers will continue to find creative ways to exploit phone numbers as long as they remain the linchpin of digital identity. Changing your number may occasionally be necessary, but it‘s a desperate act that only proves how broken our current authentication systems are.

Government and industry leaders must develop more secure ways to verify identity and safeguard consumers‘ data. But until then, being selective about giving out your number is one of the most powerful security steps you can take. Your number isn‘t truly yours – protect it accordingly.

[^1]: Federal Trade Commission Consumer Sentinel Network Data Book 2021
[^2]: Interview with Kathy Stokes, director of fraud prevention at AARP
[^3]: FBI Internet Crime Report 2021
[^4]: Javelin Strategy & Research Identity Fraud Study 2022
[^5]: MIT Technology Review, "The SIM Swap Fix That the US Isn‘t Using," September 2021
[^6]: Interview with Rebecca Moody, head of data science at Comparitech
[^7]: Princeton University, "An Empirical Study of Wireless Carrier Authentication for SIM Swaps", January 2020
[^8]: Identity Theft Resource Center Consumer Aftermath Report 2022
[^9]: Interview with Eva Velasquez, CEO of the Identity Theft Resource Center
[^10]: Electronic Frontier Foundation Surveillance Self-Defense Guide