How to remove your phone number from the dark web: a step-by-step guide

Unveiling the risks of leaked phone numbers

It can be terrifying to discover your phone number and other personal information floating around on the dark web, a hidden network of websites that’s only accessible with special software.

A distinction is often made between the deep web and the dark web. Though both keep users anonymous, some people use the deep web for legitimate reasons – such as whistleblowers contacting media members – while the dark web is a haven for criminals who collect, trade, and sell personal information for nefarious purposes.

When you hear about the ever-increasing number of data breaches, that breached info – which can include your phone number as well as name, email, address, Social Security number, credit card numbers, login credentials, and even private photos – often makes its way to the dark web. There, it’s sold or simply given away to criminals, who can then use it for ID theft, to steal your money, or engage in other illegal activity to scam you, your family, and your friends.

Breaches aren’t the only way your phone number and other personal information can get exposed on the dark web. Scammers can collect your data from various sources, including social media accounts and data brokers. Additionally, they can steal info from your devices after infecting them with malware.

In some cases, criminals can get all the data they need to scam you from a single source; in others, they combine information from multiple sources. Having solely your phone number, scammers can find enough details about its history and the owner to reconstruct your identity, impersonate you, and perpetrate any number of crimes, from SMS phishing scams to fraudulent purchases to blackmail and other illicit activity.

Consequences of a dark web phone number leak

When Colorado resident Darren Rowell received an email about a bank transfer he didn’t initiate, he knew he had to act immediately – but he wasn’t fast enough. Criminals had employed a SIM card swap attack to swindle him out of $24,500.

Unfortunately, this story is an all-too-common example of what can happen when scammers get your phone number on the dark web. All they need is a few tidbits of personal information to commit a variety of scams, including:

SIM swap

In a SIM swap, scammers impersonate you and convince your mobile service provider to switch your service to their SIM card. Once your service is rerouted to their SIM, they’ll receive all calls and text messages intended for you, including call and text-based multifactor authentication.

Once criminals can intercept multi-factor authentication codes, they can gain access to your banking, social media, email, cloud, cryptocurrency, and other accounts. Then they can:

• Transfer funds into their own accounts
• Steal your identity
• Change your passwords and lock you out
• Blackmail you or expose your private images, videos, and documents
• Make purchases in your name
• Cut off your phone, email, and social media communications

Criminals might not even need your password to infiltrate your online accounts. If they know your username and email, for example, they could simply initiate a text-based password reset.

Target you with phone scams

Once criminals have your mobile phone number, they can target you with various phone scams. They’ll often use your leaked phone number to research additional information about you, so when they call or text, they know personal details that help them gain your trust and make them appear a legitimate agency.

For example, scammers could impersonate a major retailer such as Amazon, a shipping company such as UPS, or even a government agency such as the FBI, CIA, or FTC. That’s what happened to columnist Charlotte Cowles, who writes about how she was duped into handing over $50,000 to scammers.

Criminals can also employ smishing schemes designed to get you to give up your personal information or send money. In the “Hi Mom” scam, you’ll receive an urgent text from someone (who might claim to be your son, daughter, or another close relative) who says they’ve lost or broken their phone, so they’re texting from a friend’s device. They’ll either ask you to send money so they can buy a new phone or claim they need to make a payment and ask you to forward a 2FA code so they can access your online bank accounts.  

Mine more sensitive data about you

For many cybercriminals, your cell phone number is just the start. Once they have it, they can use it to mine Google, data brokers, data breaches published on the dark web, and other sources for even more information about you.

Their goal is to match your phone number to sensitive information such as your SSN, credit card numbers, driver’s license, and home address to steal your identity or to access your online accounts, steal your money, or make purchases in your name.

Spoof your phone number

Spoofing is when scammers call or text other people while making your number show up on caller ID. In this manner, criminals can call or text your friends, family members, or coworkers – who believe you’re the one contacting them – and convince them to send money or otherwise unwittingly participate in their scam. The emergence of AI voice cloning makes it more likely criminals will attempt to deceive the people you care about with spoofing scams.

Doxx or blackmail you

Criminals can doxx or blackmail you once they’ve used your phone number as a gateway to access your sensitive accounts. This is especially true if they infiltrate your cloud photos and documents, dating apps, or social media profiles, where they can steal intimate photos, sensitive documents, and chat transcripts.

Once they have your sensitive information, they can share or sell it on the dark web, publish it for the public to see, or blackmail you by threatening to expose your photos and documents unless you pay a ransom (and even if you do, they might just keep asking for more money).

Is your number on the dark web? How to check and confirm

If you’ve noticed a recent increase in unwanted calls or spam texts or you’re getting calls from angry strangers wanting to know why you’re calling them, that could be an indication that your phone number appears on the dark web.

Unfortunately, you can’t just go to the dark web and search for phone number leaks. It’s not accessible with traditional browsers on the surface web (you need special software such as a TOR-based browser), and even if you go there, you’re not going to find search engines that reliably index the entire dark web. You have to know exactly which dark sites to look at, and it’s probably not a good idea for you to be on those sites in the first place.

The best way to know if your phone number is on the dark web, then, is to conduct a dark web scan or sign up for a dark web monitoring service – but note that these services generally only uncover phone numbers revealed in data breaches, not those published on random dark web sites.

Examples include:

• Have I Been Pwned: Enter your email address and this site will list any data leaks it’s involved in as well as which information was compromised, including phone numbers.
• DeHashed: DeHashed searches for information from breaches that have been made public. You can use it to see if your phone number appeared in a data breach.
• Google One: If you have a Google One account, you can use Google’s tool to monitor the dark web for up to ten phone numbers (free users can only run scans on their email addresses).
• Experian Dark Web Scan: Experian offers a free dark web monitoring tool that scans over 600,000 pages for your phone number.

Keep in mind that even if your number isn’t on the dark web now, you should regularly check to make sure it doesn’t get exposed and fall into the wrong hands in the future. 

Delete your phone number from the dark web: urgent steps

If you’ve discovered your phone number on the dark web, your first inclination is likely to delete it. Unfortunately, the question “How to remove your phone number from the dark web?” can’t be answered with definitive steps – you can’t really delete your phone number from the dark web. 

However, that doesn’t mean you can’t protect yourself – but it’s critical to act fast. Follow these steps.

1. Change critical passwords

Compromised passwords are gateways for scammers, so the first thing you should do is change the passwords to your most important accounts, including:

• Banking, credit card, and other financial accounts
• Cloud document and photo accounts
• Social media accounts
• Government accounts (such as tax dashboards, motor vehicles, etc.)
• Email accounts

If scammers have your phone number, it’s possible (or even likely) they have other information about you, so using strong passwords is crucial to prevent them from gaining access to your online accounts. Weak passwords are easy for scammers to crack, so use a password manager to generate complex passwords that are nearly impossible to figure out. You can also use a secure password manager such as LastPass or Dashlane to generate and save your passwords.

2. Change 2FA methods

If you use text or phone calls for two-factor authentication, switch to an authenticator app. That way, identity thieves can’t intercept your security codes via text or phone call. You can also use email authentication, but an authentication app is preferred in case scammers gain access to your email account.

Options include:

• Google Authenticator (Android | iOS)
• Duo
• Authy

3. Lock your SIM card

Next, set a SIM PIN to prevent SIM swapping scams, since your number can’t be routed to a different SIM card without the correct PIN. Each cell phone provider has its own instructions, so here’s more information from all three major carriers:

• Verizon
• AT&T
• T-Mobile

It’s also a good idea to ask your mobile service provider if they provide additional SIM protection. For example, Verizon offers Number Lock and T-Mobile has a SIM Protection option for account administrators.

4. Check your phone bill

Log in to your carrier’s online account dashboard and check for unauthorized charges, which could suggest a scammer used your phone number to make expensive outgoing calls. If you notice any suspicious activity, alert your carrier immediately.

5. Ignore or block any unknown phone number

Ignore unsolicited calls and text messages from unknown numbers and block the senders. This is good practice anyway, but particularly important if your phone number is found on the dark web since you risk answering scam calls. You can also avoid spam calls by using an automated spam blocker provided by your carrier or an app store.

6. Alert friends, family members, coworkers, and other contacts

Give your contacts a heads up that your phone number was on the dark web and it’s possible it could be spoofed. Let them know you will not be calling to ask for money, and if they receive a questionable call or text, they should verify that it actually came from you before responding.

7. Protect your identity and finances

Often, it’s not just your phone number that’s published on the dark web. If you believe your number was exposed as part of a larger data breach that might have included sensitive info such as your login credentials, credit card numbers, bank account numbers, or SSN – and it’s a safe assumption that it was – take additional steps to protect your identity and finances:

• Check your credit reports for signs of fraudulent activity such as unauthorized financial transactions. You can request your credit report from all three major credit bureaus: Experian, Equifax, and TransUnion, and you can monitor your credit score for free with an online service like Credit Karma
• Place a credit freeze or fraud alert on your accounts
• Check credit card and banking statements for unauthorized transactions
• File a complaint with the FTC at IdentityTheft.gov
• Consider purchasing identity theft protection or signing up for credit monitoring services

Once you’ve secured yourself after the initial dark web phone number leak, the next step is to implement security measures to protect your phone number and prevent other information from being compromised in the future.

Keeping personal information off the dark web: effective strategies

1. Remove your personal information from data brokers

Data brokers (aka people-search sites) scour the web for your personal information, organize it into profiles, then sell it to anyone willing to pay. Some companies segment people into broker lists for marketing purposes, while others simply sell individual profiles. Either way, they reveal tons of sensitive info about you, including your phone number, name, physical address, email, family members, credit information, and much more.

Scammers can purchase your profile and publish it on the dark web, where hackers and other criminals can match it against other information to commit identity theft and other crimes. One of the best ways to protect your privacy and avoid becoming a victim of identity theft, then, is to remove yourself from data brokers.

The law compels people-search sites to remove your information on request. However, each has its own opt-out process, and removing your info from hundreds of data broker sites can take a great deal of time. In addition, they might simply republish your information later.

Onerep can help. Our data broker removal service scans 212 people-search sites and automatically submits opt-out requests on your behalf. We use dummy phone numbers and email addresses so data brokers never get your personal information during the process. Then, we circle back to verify your info was removed and regularly monitor each site so if your information is republished, we immediately begin removal again.

2. Get a new (or virtual) phone number

If your phone number has been published on the dark web, you can always get a new phone number – though you’ll need to make sure all your contacts and accounts are updated so you don’t miss important calls.

Another option is to get a virtual or temporary phone number and use it for online accounts.

Options include:

• Google Voice
• Burner
• Hushed

3. Update privacy settings

Update your privacy and security settings to protect your phone number and other information on social media and while you’re browsing the web. For example:

• Turn off location-sharing
• Disallow search engines from indexing your social media profiles
• Limit who can see your social posts
• Disable personalized ads

In addition, avoid sharing personal details (such as your phone number) when filling out online forms, joining loyalty programs, or entering sweepstakes.

4. Browse privately

Stop others from tracking your online activities by:

• Using a VPN (virtual private network) to mask your IP address
• Installing an ad blocker
• Using a privacy-first browser, such as Opera or Brave
• Browsing in incognito mode
• Enabling safe browsing
• Avoiding public Wi-Fi
• Disabling third-party cookies, form auto-fill, and ad personalization

You should also make sure your antivirus protection is up-to-date since malware can log your keystrokes to uncover your unique passwords and other sensitive information online.

5. Remove your information from search results

It’s important to minimize your digital footprint to protect your privacy. Google will remove personally identifiable information (PII) from search results, making it more difficult for scammers to mine data about you.

• Start by searching for your phone number, name, email address, and other identifying information on Google
• If you find your information in search results, start a removal request
• Google will review your request to determine if the content meets their guidelines; if so, they will remove your information from their search results

Note that this process only removes your info from search results, not the websites they were originally published on. If you find your phone number on third-party websites, you can reach out to the site owners to request removal. 

You can also continually monitor Google for your phone number and other personal information with Google’s Results About You tool, lending peace of mind that you’ll be notified whenever your phone number surfaces in search results.

6. Delete accounts you no longer use (and be careful what you download)

Delete old profiles and close or uninstall any unused accounts and apps. Many platforms collect information about you and sell it to third-party companies, including data brokers, so removing your data and closing your accounts prevents them from sharing more info in the future.

You should also be careful about opening new accounts or downloading new apps, especially if you’re not familiar with the publisher. Double-check permissions and terms of service to make sure they’re not collecting and sharing your personal information.

In addition, set strong security questions for all accounts and consider using dummy data to make it impossible for criminals to guess your answers. For example, if one question is about the street you grew up on, use a street you never lived on for the answer.

7. Monitor data breaches

Stay informed by keeping an eye on the latest breaches so you can act fast if your phone number or other personal information is compromised. You can set up a Google Alert for “data breach” or make a habit of watching the news for major data leaks that could affect you.