7

They say it's for my own safety and that somehow my account is more "secure" if I link it with my phone number, but I don't understand why - they already have my e-mail address through which I can reset passwords. Also, what is the impact on my privacy if I give a phone number to a web service? What can they use it for?

In other words - what do I gain, and what does the service provider gain from linking my phone number to my account?

  • 1
    It's harder to steal a phone number. You gain security. They gain a phone number to sell to some numbskull who calls you saying he is with the IRS and is sending the police to arrest you. – WDS Oct 11 '15 at 18:31
  • Most web services explain that they would use your phone number in order to send text messages instead of emails when you need account service – schroeder Oct 11 '15 at 18:34
  • 1
    The main reason is to make it harder for spammers to open accounts. It's easy to get a throwaway email address, but a throwaway phone number is more difficult. – paj28 Oct 11 '15 at 19:47
  • 1
    Unless the web service is a banking website or a government e-service portal where security is important, I suggest you not to offer your phone number if you value your privacy. – Question Overflow Oct 12 '15 at 2:43
  • 1
    What I find most ironic about the use of phone numbers is, that they are less permanent than email addresses... I still have a 10 year old email address - I had a few phone numbers since then... (Because it is a hassle to port over numbers when moving to a different provider and it is easier to share the new number, or because I moved to another country.) – DetlevCM Sep 18 '18 at 8:14
8

EDIT: As this is still the accepted answer, I've made a number of changes to the below text to clarify that, while the "why" is still "probably for multi-factor authentication", this method is not trustworthy.


A phone number enables an easy way to set up two-factor authentication for things like password resets or other sensitive actions. By calling you or sending a text message, the service can confirm that [access to] the phone [number] is a thing you have. An email account is really just a thing you know, the same as a password, because you can access it without anything other than a password (and the identifier - in this case, the address itself - but identifiers are generally considered public). Thus, a two-factor password reset flow might go something like this:

  1. Click on "Forgot my password" at login.
  2. Enter your email address, and the site sends you a password reset link.
  3. Open the password reset link (which contains a secret token), thus proving that the password to your email account is something you know.
  4. Service sends you a text message with a short secret code in it (possibly after making you confirm your phone number).
  5. You enter the code from the message, thus proving that your phone is a thing you have.
  6. Two-factor authentication being completed, you can now set a new password, log into the site, etc.

The advantage to the service provider is that they are now much less likely to have to spend customer service time and possible customer goodwill walking the line between "I can't remember my password" and "somebody hacked my account". That kind of thing can be a significant cost sink, and if the site contains anything sensitive then it may lead to reputational harm to the site if they aren't paranoid enough.

Unfortunately, hijacking mobile numbers is not that hard to do. Even leaving aside technical attacks (faked cell towers or spoofing the phone or passively sniffing the radio traffic to catch the SMS that gets sent), phone companies have demonstrated that they are not trustworthy when it comes to authenticating people correctly before issuing them a new SIM with your number. As such, SMS or call-based second factors should be considered a weak additional protection, and should definitely not be trusted for single-factor authentication.

As for what the provider can do with a number, well, worst case would probably be to give or sell it to robocallers, the telephone equivalent of spam. Calling a mobile number in such a manner is actually illegal in the USA (since we're about the only place in the world that the recipient pays for incoming calls, either via prepaid credit or minutes of usage, so commercial messages without an existing business relationship are forbidden) but they happen anyhow. Realistically, though, any but the sketchiest of sites is unlikely to do anything like this (feel free to check their privacy policy, though of course there's no guarantee it's not a lie).

Second-worst thing would be to use it to send you unsolicited calls or messages, but I don't think I've ever seen this happen (do check for a "use your contact information for marketing or promotions..." option and make sure it's not selected).

In theory, the phone number might be useful to identify you personally (through a directory service / social network / phone book / whatever) and it's a lot easier to create throw-away email addresses than throw-away phone numbers. It's unlikely, though. If you're the kind of person who uses a fake name and a single-use email address when signing up for something, then putting your real phone number in there is obviously a risk. Otherwise, it's probably pretty harmless.

  • While this answer is correct, I feel it's imperative to advise readers of Security.SE to avoid using their phone number for authentication or account recovery whenever possible, due to the very real and increasing risk of phone account hijacking. – Dan Dascalescu Jul 13 '17 at 23:07
  • Sure, and it was a problem (though less-frequently) even 1.5 years ago when I wrote this answer. Still, the question was "why do they ask", not "is it secure". – CBHacking Jul 14 '17 at 7:50
  • Agree. They ask because it's the most convenient second factor. – Dan Dascalescu Jul 14 '17 at 18:57
  • @ConorMancone (and @DanDascalescu): You're right, and I should have included that in the answer initially or at least edited it in a while ago. Did that now. – CBHacking Sep 18 '18 at 8:08
3

Because it's the easiest way to obtain the second factor (something you have) in two-factor authentication. How this works was explained pretty well in CBHacking's answer. However...

Using your phone for two-factor auth is a BAD IDEA

The problem with phones is that it's surprisingly easy for hackers to social engineer their way through a telecom's customer service department and port your number to theirs, then use the phone to reset the account password.

It doesn't matter how computer-savvy you are. People in the cryptocurrency space have been hacked this way:

In the past month, there’ve been at least 10 cases of people publicly involved in the cryptocurrency scene being victimized by mobile phone hijacking. The consequences have been expensive, embarrassing, enduring, and, in at least one case, life-threatening.

The US Federal Trade Commission has put up an advisory regarding The Growing Problem of Phone Account Hijacking. More layman's coverage of phone number hijacking was recently in Forbes, for example.

Whenever possible, do not give your phone number, and choose Google Authenticator as a 2FA method. For more details, see this excellent guide by cryptocurrency exchange Kraken, or how to secure your online accounts.

  • I don't see how your computer savvy or lack of same would matter here. What does matter is how security-savvy your phone operator is. – tripleee Jul 14 '17 at 6:07
  • The obvious problem with TOTP (Google Authenticator and friends) as a 2FA solution is that if you lose the device (due to theft, damage, spontaneous failure, bad firmware, glitch requiring a factory reset, etc.), you can't ever get back into the account (unless you stored the TOTP setup key somewhere or were able to back up the app's keys, in which case you have a key storage problem). While some services offer special "recovery keys" usable if you lose your TOTP app (though again, you need to store them...), most only offer SMS as a TOTP alternative, so you have little choice but to enroll. – CBHacking Jul 14 '17 at 7:55
  • 1
    Thank you for that link to Kraken, very interesting (and slightly terrifying) read – Dunno Jul 14 '17 at 9:10
  • @tripleee: yes, that's my point too. – Dan Dascalescu Jul 14 '17 at 18:54
  • @CBHacking: correct, you need to add your TOTP keys to the files/things you back up securely. Part of the tradeoff between security and convenience. – Dan Dascalescu Jul 14 '17 at 18:56
2

I have a hypothesis that it is an identifier (non-social security number) that companies will sell to each other to track everything you do. So far I have been asked by: Vanguard, Fidelity, Bank of America, eBay, Amazon, Netflix, Yahoo, Google, LinkedIn. I think there are more, but I forget. It may be centralized because they all ask in the same manner, with the "not right now" option (never a "no, leave me alone and never ask again" option). The psychotic side of me says it is run by the NSA as an easy way to track you and everything you do (imagine, a single number code that represent an online presence and everything you do! Heaven for government snoops). The rational side of me says it is run by advertisers. Do I think it is for security? Nope. If it is for security then hypothetically you can give a different number to each company (why must it be a real phone number that they can call anyhow? Or can several people use the same shared number? Or can you set up several Skype-in numbers?). I am a naturally suspicious person and my alarm bells are going crazy these past few months. Something is not right at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.