What Your Phone Number Gives Away

A phone number is a lookup key, not a contact detail. Hand yours to a stranger and they can check whether it is registered on WhatsApp and see the photo attached to it, type it into a caller-ID directory and get a name, and find you in the files of companies whose whole business is assembling files keyed on that number. It is also the number your bank texts. If you need to be reachable at your car, use a channel you can mute, restrict or switch off.

Why “lookup key” is the right word

A number does not behave like an address. Addresses change. Numbers follow people for decades, across cities, jobs and countries, and they are the key almost every service files you under. Password resets, two-factor codes and account recovery all run through that one string of digits, which is why taking a number away from its owner — SIM swap, port-out fraud — is a named category of crime with its own regulator guidance.

So when you write the number on a card and slide it under the wiper, you are not leaving a way to be phoned. You are publishing an index entry.

What a stranger gets from the number alone

A face

In November 2025 researchers at the University of Vienna and SBA Research published the largest measurement of this that exists: Hey there! You are using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy (arXiv 2511.20252). Querying WhatsApp’s contact-discovery endpoints, they probed “over a hundred million phone numbers per hour without encountering blocking or effective rate limiting”, and enumerated 3,456,622,389 active accounts across 245 countries.

The share is the part that concerns you: 56.7% of accounts worldwide had a visible profile picture and 29.3% a custom “about” line — lines the paper found disclosing political ideology, sexual orientation, religious belief and drug use. The authors describe their own dataset as one that “would, to our knowledge, classify as the largest data leak in history, had it not been collated as part of a responsibly-conducted research study”. They deleted it before publishing, and the paper records that the rate-limiting weakness was remediated.

Two things follow. A number alone proves that someone uses WhatsApp at all, which is dangerous by itself where the app is banned — the team found active accounts in China, Iran and Myanmar, and five inside North Korea’s number range. And for more than half of the world’s accounts, a number returned a face.

Check yours: WhatsApp → Settings → Privacy. “Profile photo”, “About” and “Last seen and online” each offer Everyone / My contacts / My contacts except… / Nobody. Anything left on Everyone is visible to whoever reads the number off your dashboard.

A name

Caller-ID directories are built from the address books their own users upload, so a number typed into one often comes back with a name attached. That is the product working as designed, not a leak. Truecaller, the best known of them, is also the most effective spam filter many people will ever install, and it publishes an unlisting page at truecaller.com/unlisting — check its current terms there before you use it. The service is genuinely useful. It simply runs in both directions.

A file

California law defines a data broker as a business that collects and sells information about people who never dealt with it directly. More than 500 are registered in that one state. Since 1 January 2026 a Californian can send a single deletion request to all of them through the state’s Delete Request and Opt-out Platform (DROP); brokers start processing those requests in late summer 2026 and must then check the platform every 45 days. In the EU and UK the equivalent is a GDPR Article 17 erasure request, sent broker by broker.

The registry is the useful fact here, not the remedy. Five hundred companies, in one US state, whose entire business is assembling files keyed on identifiers like the one on your dashboard.

An entry that does not expire

Numbers do not come off lists. Ireland’s Data Protection Commission fined Meta €265 million on 28 November 2022 over a scraped dataset of Facebook users’ personal data, for breaching GDPR Articles 25(1) and 25(2). The Vienna team ran the phone numbers from that 2021 scrape against live accounts years later: about half were still in use. A file built on your number stays useful for exactly as long as you keep the number.

The harassment risk, stated exactly as the evidence supports it

Everyone else overstates this, so here is the honest version in two parts.

What is documented. The US Bureau of Justice Statistics’ Stalking Victimization, 2019 (NCJ 301735, February 2022) found 3.4 million people aged 16 or over — 1.3% of that population — stalked in a single year, and women stalked more than twice as often as men (1.8% versus 0.8%). Among victims of stalking with technology, 66% received unwanted phone calls, voice messages or texts: the most common tactic recorded, ahead of email and social media at 55%. Fewer than a third, 29%, reported any of it to police.

What is not documented. I could not find a published case in which stalking or harassment was traced specifically to a phone number displayed on a car dashboard. The chain is a reasonable inference from two verified links — a number resolves to a name and often a face, and unwanted phone contact is the commonest technology-stalking tactic on record — but an inference is not a case. Anyone selling you something on the strength of a specific dashboard-stalking incident is inventing it, and that includes us.

The awkward part: the law still wants a note

None of this makes the windscreen note stupid. In several countries, leaving one after you hit an unattended parked car is not a courtesy. It is the legal obligation.

• Great Britain. Road Traffic Act 1988, s.170(2): you must stop and, if asked by anyone with reasonable grounds, “give his name and address and also the name and address of the owner and the identification marks of the vehicle”. If nobody is there to receive it, s.170(6) requires you to report at a police station or to a constable “as soon as is reasonably practicable and, in any case, within twenty-four hours of the occurrence of the accident”.
• California. Vehicle Code §20002(a)(2): “leave in a conspicuous place on the vehicle or other property damaged a written notice” giving “the name and address of the driver and of the owner of the vehicle involved and a statement of the circumstances thereof”, then notify the city police or the CHP “without unnecessary delay”.
• Germany. §142 StGB does not accept a note as a substitute. You must wait “eine nach den Umständen angemessene Zeit”; if nobody comes, you must afterwards tell the entitled person or a nearby police station that you were involved, give your registration and the location of your vehicle, and keep it available for inspection for a reasonable period.

Read those three again and notice what none of them asks for: a telephone number. Name, address, the owner’s details, the vehicle’s identification marks, a report to police inside a deadline. That is the legal minimum in every text I could verify.

The phone number is the part people add on top, so the other side can sort it out with a call instead of paperwork. That is a real convenience and a rational trade. It is also a cost, and almost nobody prices it: a permanent identity key, on display to everyone who walks past, for as long as the car is parked.

What to do instead, ranked by effort

1. Lock the number down first — ten minutes, nothing to buy. WhatsApp → Settings → Privacy: set Profile photo, About and Last seen to My contacts or Nobody. Signal announced on 20 February 2024 that your number is hidden by default from people who do not already have it saved, and added usernames so you can be reached without giving a number at all — set “Who can find me by number” to Nobody. Ask your carrier for a port-out PIN. Californians: file one DROP request. In the EU or UK: send Article 17 erasure requests to the brokers you find yourself in.

2. Use a number that is not the number. A second eSIM or a VoIP line can be thrown away when it starts ringing. This is the most underrated fix on the list, because the harm was never “a stranger can call me”. The harm is “a stranger can call the number my bank texts”.

3. Hide-plates. Flip covers, slide-out bodies and retractables, sold as privacy accessories — the category has already conceded the argument. Plenty of people are happy with them. Two things to be clear about: the number is still printed there, and a hide mechanism protects you only as often as you remember to close it.

4. QR contact stickers. Several vendors print a QR code that routes a stranger to you by masked call, SMS or messenger without showing your number. They beat every app at one thing, and it is the thing that matters at the moment of contact: the finder needs nothing at all — any phone camera, no download, no account — and friction is what kills a message about your lights. Their structural limit is equally plain: they work only on a car whose owner already bought one and stuck it on.

5. Plate-addressed messaging. re:plyte is a free iOS and Android app. Pick the issuing country and the licence plate, choose a reason, send a message — text, photo, voice note or location. Neither side ever sees a phone number. The owner chooses which reasons they accept and sets quiet hours, which is the one thing a printed number can never do: a number cannot tell “your lights are on” at 14:00 from an abusive call at 03:00. A claimed car also gets an opaque QR contact sticker and a free printable PDF. The honest limits: the sender needs the app, the owner may not have it, a message to a plate nobody has claimed waits up to 30 days and then expires, it is not instant the way a phone call is, and it does nothing in a genuine emergency — call your local emergency number for that.

In short

• A number is a lookup key. It survives moves and job changes, and password resets, two-factor codes and account recovery all run through it.
• From a number alone, 56.7% of the 3.5 billion WhatsApp accounts measured in 2025 returned a profile photo, and caller-ID directories return a name.
• Unwanted phone contact is the most common technology-stalking tactic on record (66% of victims), and women are stalked at more than twice the rate of men.
• No published case ties harassment specifically to a number displayed on a dashboard. Treat that risk as reasoned, not reported, and be suspicious of anyone who claims otherwise.
• After you hit a parked car the law asks for a name, an address and a police report inside a deadline. Never a phone number. The number is the part you volunteer.

General information, not legal advice. Updated August 2026.