How can a website like mobilepay.it know your telephone number?

Question

Recently I had to disable some paid services on a mobile phone (those kind of annoying services that automatically enable when you visit some particular websites and cost lots of money). To do so I visited the website

http://selfcare.mobilepay.it

I was expecting some kind of authentication like

put your mobile number here - receive an SMS - enter the SMS code you just received here

Instead I was presented with a page where I was already authenticated and my mobile number was displayed, there I could manage my payments etc.

How can websites like mobilepay.it know my mobile number?

I checked the website https://www.mulliner.org/pc.cgi to see if my mobile number was shared via HTTP headers but I couldn't see anything suspicious.

Note: Sometimes visiting the mobilepay selfcare webpage from a computer connected to the internet via a portable router with a sim inside (and a mobile number) shows you the administration page for that number, visiting the selfcare from a mobile phone connected in the same way of the computer before (so with a portable router) shows you a page where you have to put your mobile number.

Answer 1

I believe the MSISDN (phone number) is passed over by the Mobile operator directly to the mobilepay.it server. When you are connected to a 4G or 3G network your mobile network operator knows this information and it can pass over to any application server if it has an agreement. I am also interested to know what protocol they use, anyway for sure mobilepay.it has agreements will all service providers in Italy. When you browse using a PC on a Wifi, or your mobile phone on a wifi they don't detect your number. If you use a wifi but your connection is a 3G/4G, e.g. tethering on a mobile phone or 4G router, they may detect the 3G router SIM MSISDN, but it depends on the device and hotspot configuration, I guess.

Answer 2

Short answer: Some carriers do store phone number in the SIM cards and if it's stored, a web application can retrieve it if it's built that way.

If the phone number is not stored anywhere from where it can be automatically retrieved (most cases, I think) then the user has to enter their number manually.

There is a development related discussion about it here: https://stackoverflow.com/questions/2480288/programmatically-obtain-the-phone-number-of-the-android-phone#comment2472240_2480307

but if that's not what interests you then it's enough to know that some carriers do store phone numbers in their SIM cards and it's possible to retrieve them.