Find accounts linked to your phone number

A phone number is no longer just for calls and texts. It has become a second form of ID that ties your identity together across dozens of services. That is convenient, but it also means one number can be a single point of failure.

• SMS two-factor authentication. Banks, email providers and social platforms send a one-time code to confirm it is really you. Once you verify a number this way, that service stores it and links it to your account.
• Messaging apps. WhatsApp, Signal and Telegram all use your phone number as your account identifier. Depending on your privacy settings, anyone with your number may see your profile photo or last-seen status.
• Account recovery. Google, Apple, Microsoft and most banks let you reset a password using a phone number. Useful when you are locked out, but it also makes the number a backdoor into the account.
• Recycled numbers. When you cancel an Australian mobile plan, the carrier can eventually reassign that number. If you did not unlink it first, whoever gets it may receive password-reset codes meant for you.

Start with what you already control, which takes about five minutes:

• Android:Settings › Google › Manage your Google Account › Personal info › Contact info › Phone. This shows the number Google holds and how it is being used, for sign-in, recovery, or both.
• iPhone:Settings › [your name] › Sign-in & Security. Under “Phone Numbers for Two-Factor Authentication” you will see every trusted number linked to your Apple Account.
• Your carrier: log in to your telco app or website and check the account security settings. Most now show recent SIM or porting activity there.

Most large platforms let you check whether a number is already registered from their own login or password-reset screen, which is the quickest way to confirm a link without a third-party tool.

• Try your number in the “forgot password” or “sign in with phone” flow on Google, Facebook, Instagram, WhatsApp and Telegram. If the service recognises the number, it is linked.
• Check banking apps and super funds. Most have a contact-details page listing the mobile number on file.
• Check any account where you have ever ticked “send me a text to verify”.

• Reverse-lookup and caller-ID appssuch as Truecaller crowdsource numbers from other people's contact books, so your number, name and even a photo may be visible to strangers without your consent. Search your own number and use the unlisting form if you find an entry.
• People-search sites sometimes list a mobile number alongside an address or past employer, usually scraped from public records or old breaches.

If your number rather than just your email has appeared in a breach, it is worth knowing which services exposed it, because that tells you where to prioritise. Our guide on how to find accounts linked to your email walks through the same process for your inbox and pairs well with this one, since email and phone recovery options are usually attached to the same accounts. If you already know your email has been caught up in an incident, see what to do if your email is in a data breach.

A SIM swap is when someone convinces your telco to move your number to a SIM they control, usually by impersonating you, so they can intercept your SMS codes. Since 2022, Australian telcos have been required by the ACMA's customer identity authentication rules to use stronger checks before porting a number or approving high-risk account changes. You can add another layer yourself:

• Set a porting PIN or account PIN with your carrier. Telstra calls this a Telstra PIN; Optus, Vodafone and TPG have equivalents. A port-out request then cannot proceed on ID alone.
• Turn on account alerts for SIM or plan changes if your telco offers them.
• Where possible, move critical accounts from SMS codes to an authenticator app or passkey, which is not vulnerable to number porting at all. Our comparison of a password manager vs breach monitor vs digital footprint manager breaks down what each tool actually protects.

Before you cancel your old SIM or let a number lapse:

1. List your recovery-critical accounts first: email, banking, super, myGov, and anything using SMS codes.
2. Update the numberin each account's security settings before the old one is disconnected.
3. Remove the old number from any account where it is no longer needed, rather than leaving it as a stale recovery option.
4. Tell your bank and myGov directly. These often need a phone call or in-app confirmation rather than a settings change.
5. Keep the old SIM active for a week or two if you can, as a safety net while you migrate two-factor authentication.

In The Event Of is built around turning scattered account records into a single map. You can connect a supported inbox (Gmail or Outlook) so it can scan for account-related metadata, sender addresses, subject lines and timestamps rather than the body of your emails, or add services manually. It then organises what it finds into a digital footprint, highlights breach exposure, and gives you guided steps for each account, including which ones still rely on your phone number for recovery. You stay in control of every change.