Recently I had to disable some paid services on a mobile phone (those kind of annoying services that automatically enable when you visit some particular websites and cost lots of money). To do so I visited the website
I was expecting some kind of authentication like
put your mobile number here - receive an SMS - enter the SMS code you just received here
Instead I was presented with a page where I was already authenticated and my mobile number was displayed, there I could manage my payments etc.
How can websites like mobilepay.it know my mobile number?
I checked the website https://www.mulliner.org/pc.cgi to see if my mobile number was shared via HTTP headers but I couldn't see anything suspicious.
Note: Sometimes visiting the mobilepay selfcare webpage from a computer connected to the internet via a portable router with a sim inside (and a mobile number) shows you the administration page for that number, visiting the selfcare from a mobile phone connected in the same way of the computer before (so with a portable router) shows you a page where you have to put your mobile number.