3

TLDR: What are the risks, consequences, of giving my phone number to civilian people I meet while socializing/dating or in casual life? If a bad actor gets my phone number, what attacks to expect, and how can protect myself from their attacks?

Disclaimer: I'm a super beginner in security as you'll easily find out by reading below. This is a question from a casual person, with the goal of informing casual, non-expert people like me, that I think, for example, a great chunk of women have while hesitating to give phone numbers to men they like but aren't sure they are violent/going to use phone number to do violent oppressive acts. In my experience people hesitate to give their phone numbers in my country, I want to know how unsafe this really is, and what is the solution.

So, I want to date people, to give my numbers to them, or to friends, I met casually in the street / outside, and, analogously, I'm worried THEY are worried/freaking out UNJUSTIFIEDLY about giving their phone number to me. I have researched about the posssible dangers of giving your number, and they don't scare me very much, except possibly the 2 factor authentication, for which the solution is to not have 2-factor authentication with a phone number to start with..

The problem of getting harassed/stalked requires the harasser to change numbers, which I would like if you answer me if they manage to do that or are stopped by the phone company, of course depends on company and country. In case they do, they can't avoid spending money calling me, while I just hang up if I don't hear a familiar hello. I don't see any scenario where this calls lead to me being in more danger than without the calls, the calls themselves just make my phone ring, how could that more than annoy me?

Also, if giving our phones number were that dangerous, then it's extremely in dissonance of how 99.9% conduct themselves in real life. Surely 99% has given their phone to friends, school were the kids go, the telephone directory, gym, dates... I mean, if start today not giving my phone number, that doesn't erase the already hundreds of entities I have shared my number with. So, if I already shared my number with others, maybe now it's on a call-spammer list and people can buy it online. Also, giving phone number can be bad for identity theft.

If giving phone number is dangerous, because of reasons I'm overlooking, is a solution to that to give email such as gmail? Because then, to spam you they would need to surpass google spam filter which is remarkably hard.

  • 1
    Giving your name offers far more security risks than a phone number. – schroeder Feb 6 '18 at 23:22
  • @schroeder Hi, I hope you can clarify that! You mean giving name and surname? You mean to strangers on the street? Is the problem giving my face while saying my name, connecting the two? I don't disagree with you, but then that implies that American culture, where is it super custom to present yourself by giving your name is really unsafe tradition (I'm just trying to imply this, not to go against your advice!) – Santropedro Feb 6 '18 at 23:24
  • 3
    "Safe" is just a risk that is under an acceptable threshold. One can do far more with your face and name than can be done with just a phone number. There are risks, but in the scope of risks in the typical dating scenario that you describe, there are much greater risks that eclipse phone numbers. Interacting with people is a risk, but an acceptable one. Some do not think so, and shut themselves away. But the risk/benefit ratio tends to favour accepting the benefits with the risks. – schroeder Feb 6 '18 at 23:31
  • @schroeder I agree with you of the cost/benefits of accepting risks 100% and that we musst evaluate correctly the probabilities of different scenarios, and see if our fears and the shutting down is better than engaging in certain activities, yes 100% agree. When I asked this question i understood this thing. Althought, thanks for telling me about the name/face danger is bigger than the face/phone (I suppose you meant giving phone number to people that see my face, or maybe you didn't mean that?). Then, I think using a fake name is probably a advisable thing to do. – Santropedro Feb 6 '18 at 23:37
  • @schroeder Using fake name in my country even If i wanted (an idea I just fabricated to debate with you) , is something would need institutional support, since banks, schools, and other state services publicly display your information is this country (Argentina), so probably in the future I'll do it. I don't think people will get upset after knowing I gave them a fake name, I can say it's an alias (And the alias I can throw away every year, yes sounds insane but maybe it's the best) – Santropedro Feb 6 '18 at 23:40
2

Today a phone number is as much PII as your SSN, credit card number, or physical address. Aside from that, it could be painful and time consuming to change you phone number.

Consider using Google Voice, Sudo (https://sudoapp.com/) or Blur (https://www.abine.com/index.html) to mask your real phone number. Sudo allows you to create a compartmentalized personas complete with email and phone. If the masked number is compromised somehow, you simply throw it away.

  • Today a phone number is as much PII as my adress or credit card number? Please give me arguments to believe that sentence. – Santropedro Feb 8 '18 at 20:07
1

You've decided to give out your subscribed phone number to someone

Once a person has your number the types of attacks possible is somewhat limited to whatever attack vectors exist at your carrier level. That's not to say you're safe, it's to say you're at the mercy of whatever security theater is present at whoever provides you phone service beyond just the typical spam, pranks, and possible stalker. This could have some implications like easy to bypass security questions leading to leaked identity data.

Hopefully that would not include your government mandated social identification numbers and just your public persona information like address, email, etc., but sometimes companies store than information and someone is looking for a special someone.

However this is all a moot point if they attack the phone provider in all reality, and in the end you're only as safe as the phone company keeps you aside from a personal physical interaction layer.

Keeping yourself safe

If you don't want to worry about these attacks, annoyances, and how secure your provider is a better question in this day and age of connected services is "Why should I have to give out my phone number?"

With instant messengers being so accessible on smartphones, email, facebook, and social networks what major reason would you have to give out your phone number in the first place? Why not use another more secure form of communication that you can later give them your phone number through when you trust them?

Heck you can even use Google Voice or other apps like it to get a number that can text and make calls that isn't your subscriber number and can be easily changed.

There really isn't a reason to give our your subscriber number if you don't want to.

  • 2
    Yes I agree with the perspective you take (correct me if I'm wrong) is that as the paragraph "There really isn't a reason to give our your subscriber number if you don't want to.", If someone is afraid of giving phone number, they have great alternatives, in fact since most people in my country and in vast areas of the world have internet access **even outdoors" you can communicate with the other messaging services satisfactorily. I hope this trend of not using phone number becomes socially acceptable, to let me not using more phone and to rely in other services like gmail. – Santropedro Feb 7 '18 at 0:15
  • Then you might want to give an upvote even if you don't accept it as the accepted answer. Upvotes mean this answer provides helpful information – Robert Mennell Feb 7 '18 at 0:18
0

If your phone number is compromised (because the person you gave your number to happens to be a criminal, or maybe one stole the phone of someone who has your number), most likely, they wouldn't do much more than add your number to a list which gets sold to spam marketing companies.It would be annoying but probably wouldn't necessitate changing your number.

I suppose a worst case scenario could be that there are some services that use your phone number as an account verification by matching your caller ID. Perhaps an attacker could spoof your phone number when calling your bank (or other service company), and coupled with one additional security detail such as your date of birth, they may be able to fully verify themselves and initiate new transactions without your consent.

If you're really concerned perhaps the simplest solution is to obtain a forwarding service (like Google Voice in the US) which gives you a phone number that masks your real number.

  • I'm amazed at reading the second paragraph in this sense: While I don't contest that the bank can be that insecure, it's very very super insecure to give more access to someone just because they know a phone number. I'm convinced it happens in part because normal civilian users (no offense hopefully to them, but it's the truth) are too impatient/disorganized to even have a password that is more complex than their pet's name or 1234. Because of them, sometimes they will have only their own number as confimation, so the bank indulges in this unsafe practice to please them. Is this right? – Santropedro Feb 8 '18 at 5:14
  • Off hand I can't think of a bank that uses caller ID and a single piece of other information to verify, but I feel like that could very well be the case. Sometimes I recall getting asked for full name, DOB, and last 4 of my social security number, or perhaps even mother's maiden name or something similar. One of my banks that I called recently sent me a text message and asked me to repeat the code to them over the phone to prove that I actually had my mobile in my possession, which is a little better... In general though, the takeaway is that a phone number is sometimes one part of ID. – TTT Feb 8 '18 at 16:47
0

Do not give out your number to someone unless you want them to be able to see/read your facebook!

Did my first sentence catch your attention? Great, because giving out your phone number is way more dangerous than expected. Facebook, and many other social media sites, request a level of permission to scrape your contacts for "connections"... this works both ways. If you've given your number to someone they will start to get notifications that they can friend you and etc. Granted, if they have your phone number they will almost surely be able to do some research or social engineering to get your full name anyway.

So this brings us to the bigger question... what can a malicous actor do with your phone number, full name, and the ability to ask you personal questions and scrape through your accounts for more information. The answer is -a lot-.

Professional hackers are not out hunting for random strangers (at least, that's not common, just like pro fighters are rarely seen in bars fighting strangers for no reason). That said, if one gets this level of info there are huge attacks that can be launched against you.

An email to your work email (your.name[1-10]@[yourwork].com) from a client desperately asking for "the PO their boss lost!!" "OMG I'm going to get fired!!" The hacker knows your client because you told them about exciting/frustrating job. They scrape linkedin and probably find a real person you've worked at. "real.person@gmail.com" is where the email comes from.

Obviously, much worse can happen. Be careful!

Be careful!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.