How to find apps and accounts linked to your phone number

A phone number is no longer just for calls and texts. It has become a second form of ID that ties your identity together across dozens of services. That is convenient, but it also means one number can be a single point of failure.

• SMS two-factor authentication. Banks, email providers and social platforms send a one-time code to confirm it is really you. Once you verify a number this way, that service stores it and links it to your account.
• Messaging apps. WhatsApp, Signal and Telegram all use your phone number as your account identifier. Depending on your privacy settings, anyone with your number may see your profile photo or last-seen status.
• Account recovery. Google, Apple, Microsoft and most banks let you reset a password using a phone number. Useful when you are locked out, but it also makes the number a backdoor into the account.
• Recycled numbers. When you cancel an Australian mobile plan, the carrier can eventually reassign that number. If you did not unlink it first, whoever gets it may receive password-reset codes meant for you.

There is no central register of the apps holding your number, so the methods below each reconstruct part of it. They are ordered by yield: the first finds the most, and each one after it exists to catch what the earlier ones structurally cannot.

Your text messages are to your phone number what your inbox is to your email address. Nearly every app that has your number has sent it a verification or login code, and those texts arrive from a named sender, so searching for them produces a list of services quickly. Search for these terms one at a time:

• Android (Google Messages): tap the search icon at the top of the conversation list. Also scroll the conversation list itself, because each named sender, such as a bank, a delivery service or an app, is its own thread.
• iPhone (Messages): swipe down on the conversation list to reveal the search field. If you filter unknown senders, check that list too, because code texts from services you have never saved as contacts often land there.

Write down every distinct service name you see. Do not dismiss a sender because you do not recognise it, an unfamiliar code text is exactly the forgotten account this exercise is meant to find. If you have changed phones without restoring your messages, older codes will be missing, which is why the methods below matter.

On Android, your Google Account is the hub, and it is the one place that tells you exactly how a number is being used rather than leaving you to guess.

• Where Google uses the number: Settings › Google › Manage your Google Account › Personal info › Phone, then select the number. The Usage section lists where Google uses it across its services, including sign-in and account recovery, and lets you remove it from each.
• Apps signed in on the phone: open the accounts list in Settings, usually under Passwords & accounts, or Accounts and backup › Manage accounts on Samsung. It shows every app that has added an account to the device.
• Apps you signed in to with Google: your connections to third-party apps and services lists every app you used “Sign in with Google” for. Many of those apps also asked for your number at signup.

On iPhone, the equivalent views live in your Apple Account:

• Trusted numbers: Settings › [your name] › Sign-In & Security. Under the phone numbers used for two-factor authentication you will see every trusted number linked to your Apple Account, including old ones you may have forgotten to remove.
• Apps using Sign in with Apple: from the same screen, Sign in with Apple lists each app that uses it and lets you stop using Apple sign-in for any of them.
• Saved passwords: the Passwords app (or Settings › Passwords on older iOS) lists every saved login. Any account there that offered SMS codes probably holds your number.

Some platforms do not just store your number, they use it as your login. These are the ones that matter most if the number is ever lost or hijacked, so check each one directly:

• Messaging apps: WhatsApp, Signal, Telegram and Viber register you by number. If you have ever installed one, the account exists until you delete it from inside the app.
• Social apps: Facebook and Instagram list the number under Accounts Centre › Personal details › Contact info. TikTok, Snapchat and X show it in their account or security settings.
• Banks, super funds and myGov: each has a contact details page listing the mobile number on file. These are the accounts where an out-of-date number hurts most.
• Anything you are unsure about: the “forgot password” or “sign in with phone” screen will usually tell you whether the service recognises your number. Only do this for your own number.

• Reverse-lookup and caller-ID apps such as Truecaller crowdsource numbers from other people's contact books, so your number, name and even a photo may be visible to strangers without your consent. Search your own number and use the unlisting form if you find an entry.
• People-search sites sometimes list a mobile number alongside an address or past employer, usually scraped from public records or old breaches.
• Breach checks mostly search by email rather than phone number, but breached records usually store the two together. Every service named in your email's breach results probably held your number too. Our guide on how to find accounts linked to your email walks through the same process for your inbox, and pairs well with this one. If your email is already in a breach, see what to do if your email is in a data breach.

Pull everything into a single list. For each account, note the service, whether the number is used for sign-in, recovery or just contact, and whether you still need the account. Close the ones you do not need, and remove the number from any account where it is only a stale recovery option.

Then secure the number itself. A SIM swap is when someone convinces your telco to move your number to a SIM they control, usually by impersonating you, so they can intercept your SMS codes. Since 2022, Australian telcos have been required by the ACMA's customer identity authentication rules to use stronger checks before porting a number or approving high-risk account changes. You can add another layer yourself:

• Set a porting PIN or account PIN with your carrier. Telstra calls this a Telstra PIN; Optus, Vodafone and TPG have equivalents. A port-out request then cannot proceed on ID alone.
• Log in to your telco app or website and check the recent SIM and porting activity. Turn on alerts for SIM or plan changes if your telco offers them.
• Where possible, move critical accounts from SMS codes to an authenticator app or passkey, which is not vulnerable to number porting at all. Our comparison of a password manager vs breach monitor vs digital footprint manager breaks down what each tool actually protects.

Before you cancel your old SIM or let a number lapse:

1. List your recovery-critical accounts first: email, banking, super, myGov, and anything using SMS codes.
2. Update the number in each account's security settings before the old one is disconnected.
3. Remove the old number from any account where it is no longer needed, rather than leaving it as a stale recovery option.
4. Tell your bank and myGov directly. These often need a phone call or in-app confirmation rather than a settings change.
5. Keep the old SIM active for a week or two if you can, as a safety net while you migrate two-factor authentication.

In The Event Of is built around turning scattered account records into a single map. You can connect a supported inbox (Gmail or Outlook) so it can scan for account-related metadata, sender addresses, subject lines and timestamps rather than the body of your emails, or add services manually. It then organises what it finds into a digital footprint, highlights breach exposure, and gives you guided steps for each account, including which ones still rely on your phone number for recovery. You decide what to close, update or keep: In The Event Of makes no changes at the services you use, except through optional features you turn on, such as Scam Radar, which asks for broader inbox access and can label messages in your inbox. The Free tier is A$0 and does not require a credit card.