A scammer has your phone number. Here is what it is worth to them, rung by rung.
You gave it to a caller before you understood the call, or it turned up in a breach, or a text arrived that knew your name. The question people type at that moment is what can they do with it. The honest answer is a ladder, not a list, because a number on its own is worth very little and a number with one more thing beside it is worth a great deal. This is the ladder, with what stops each rung.
With your phone number alone, a scammer can call you, text you, spoof your number to other people, sell it as a live lead, and try to attach a name to it through people-search sites. They cannot read your messages, see your location, install anything, or reach your bank from the number by itself. The number becomes dangerous in exactly two ways: when it is moved to their SIM at your carrier, which hands them every code your bank and email send, and when you answer the follow-up call. Tonight: switch on your carrier's number lock, move two-factor codes off SMS, and never call a number back.
"If you answer the phone and the caller, or a recording, asks you to hit a button to stop getting the calls, you should just hang up. Scammers often use this trick to identify potential targets."
I sold for a living before I did this, and I want to start with the thing the security-software articles on this question never say, because they are selling you something and I am not. A phone number, to the people who run scam operations, is a lead. Not a victim, not a target, a lead: a row on a list with a price on it. The price goes up every time the number does something. It answered. It pressed one. It called back. It gave a name. Every one of those moves your row up the list and raises what the next buyer pays for it. The first call is almost never the con. It is the qualification. The con is the second call, from a better closer, who now knows you answer.
That is why the question "what can they do with my number" has a two-part answer. What they can do with the number is small. What they can do with a number that answers is the entire industry.
The ladder: what each rung unlocks, and what it still cannot
Read the four rungs below from the top. The first three are annoyance and social engineering, which is to say they work only if you do something. The fourth is the only rung where the number itself takes your money, and it is the one rung a free setting at your carrier removes.
Rung one: the number alone, and the three things it is actually used for
With nothing but the number, a criminal has a channel and a commodity. The channel is obvious: they can ring it and text it, as often as they like, from as many numbers as they like. The commodity is less obvious and matters more.
What the number alone does not do is any of the things people fear most. It does not let anyone read your texts, listen to your calls, see where you are or put software on your phone. There is no version of that which works from a number. When someone describes being "hacked by phone number", one of the two higher rungs is what actually happened.
Rungs two and three: the call that knows your name
Add a name and the number becomes a script. A caller who opens with your first name, your bank's name and a plausible reason is most of the way to a successful call before you have said a word, because the details do the work that trust would otherwise have to do. Add an address, a date of birth or the email you use for everything and the caller can pass the identity checks that some companies still run by question, and can try the password-reset flows on accounts that treat your phone number as proof that you are you.
The defence at these rungs is not secrecy, because the details are already out there. It is refusing to let a call be the place where anything is decided. The FCC's guidance is the same for every one of these calls, and it is short: if someone says they are calling from a company or a government agency, hang up and call back using an official phone number from an account statement or their website. The reason the callers sound so official is that sounding official is the product, and it is cheap.
Rung four: the only rung where the number itself takes money
Everything above needs you to do something. Rung four does not. If a criminal can persuade your carrier to move your number onto a SIM they hold, or to switch it to a new phone, every text sent to your number arrives on theirs. That includes the six-digit codes your bank, your email and your payment apps send when someone tries to log in or reset a password. From that moment the criminal is not pretending to be you; to every system that trusts your number, they are you.
This is the SIM swap, or port-out, and it is the reason the phrase "your phone number is the key to everything" is true in a way most people do not mean. The FCC adopted rules requiring carriers to authenticate a customer before a SIM change or a number transfer and to offer account locks against both, and every major carrier now has one: AT&T calls it Wireless Account Lock, Verizon calls it Number Lock, T-Mobile has its own. They are free and they are off until you switch them on. We laid out what each carrier calls the lock and why a SIM PIN is not the same thing; if you read one other page after this one, read that.
How they got the number, and why it keeps ringing
People ask this as if the answer might be a specific slip they made. It almost never is. Numbers leak in breaches, sit on people-search sites, are scraped from profiles and sold by data brokers, and are typed into a hundred forms a year. The useful question is not how they got it but what they learned from you after they had it, because that is the part you control. A recording that asks you to press a key to stop the calls is, in the FCC's own words, a trick scammers often use to identify potential targets. The number that presses the key is now a number that answers, and it is sold as one.
The same logic runs the second wave. The FBI's Internet Crime Complaint Center warned again in July 2026 about a scheme that targets previous victims, in which criminals impersonating FBI personnel contact people who have just been scammed and claim to have recovered the lost funds. A number that has been scammed is the most valuable number on any list, and the recovery scam is built entirely on that fact.
What to do tonight, in order
Fifteen minutes, in this order, and the number in the criminal's hands stops being worth anything to them. Nothing here costs money and nothing requires a new number.
- 1.Switch on the number lock at your carrier. Log in to your carrier account or app and turn on the port-out protection, whatever your carrier calls it. The carrier-by-carrier names are here. This is the only step that closes rung four.
- 2.Move two-factor codes off SMS for your bank, your main email and your payment apps. Choose an authenticator app or a passkey in each account's security settings. Your email first, because it resets everything else.
- 3.Put a password on your voicemail. The FCC notes that some voicemail services allow access to anyone calling from your own number, and a spoofed number is your own number as far as the system can tell.
- 4.Stop answering unknown numbers, and hang up on any call that asks for money or personal information. Both are the FCC's words. Let it go to voicemail; a real caller with a real reason leaves one.
- 5.Report the texts and calls. Forward a scam text to 7726, which most carriers use to block spam, then report the call or text at ReportFraud.ftc.gov. If the caller ID was faked, file a complaint with the FCC. Reporting does not stop the calls today; it is what the enforcement numbers are built from.
- 6.Turn on your carrier's call filtering and block the numbers you have. Every major carrier offers a free scam-call filter, and your phone can silence unknown callers. Blocking one number does little, because the next call comes from another one; the filter is what does the work.
- 7.Change any password you typed after a call or a text, and turn on two-factor there. That is the FTC's own instruction for anyone who gave a scammer account details, and it is the step people skip because the call felt like nothing.
- 8.Expect the second call, and treat it as the scam. Anyone who contacts you afterwards claiming to have traced the number, recovered your money or found your case is working the same list from the other side. No genuine agency asks a victim for money to return money.
Should you change your number?
Usually not, and never first. A new number does nothing for the accounts that still trust the old one, and the old number stays on every list it was on the day before. Change it if the calls continue after you have filtered, blocked and stopped answering for a few weeks, or if your number was actually moved to another SIM and the carrier cannot restore it cleanly. Otherwise the number is not the asset. What it can reach is, and the eight steps above are how you cut it off from all of that.
What to do with the scammer's number
This is the mirror question, and the answer is shorter. Report it, block it, and do nothing else with it. Do not call it, because the number you see is very often spoofed and belongs to someone who has no idea it was used. Do not pay anyone to trace it, unmask it or use it to recover what you sent; the routes that can get money back run through your bank and the regulators, never through a tracer. If you are not sure what you are looking at, the scam checker routes a number, a text or a link to the right check in three taps.
Your number is on a list, and it always was. What the list cannot tell anyone is whether the number answers, and every part of this that is dangerous begins the moment it does.
What can a scammer do with just my phone number?
With the number alone they can call and text you, spoof it so calls to other people appear to come from you, sell it on as a confirmed live number, and run it through people-search sites to try to attach a name and an address. They cannot read your messages, see your location, install anything on your phone or get into your bank from the number by itself. The two things that turn a number into a loss are a SIM swap or port-out at your carrier, which hands them your texts and your six-digit codes, and you answering the follow-up call. Both have a free fix: a number lock at your carrier, and a rule never to call a number back.
Should I be worried if a scammer has my phone number?
Worried enough to spend fifteen minutes, not enough to change your life. Your number is already on lists: every account you have ever given it to, every breach that included it, every people-search site. What matters is what sits behind it. Switch on your carrier's number lock so the number cannot be moved to another SIM without an extra step, move your bank and email two-factor codes off SMS and onto an authenticator app, put a password on your voicemail, and stop answering calls from numbers you do not know. Done in that order, a scammer holding your number is holding a lead they cannot convert.
Can a scammer hack my phone with my phone number?
Not from the number alone. There is no way to install software on a phone or read its messages by knowing its number. What people describe as being hacked by number is almost always one of two other things. Either they tapped a link in a text and typed a password into a copy of a real site, or their number was moved to a criminal's SIM at the carrier, after which every code sent to that number arrived on the criminal's phone. The first is prevented by never using a link from a message; the second by a carrier number lock, which the FCC requires carriers to offer.
Should I change my phone number if a scammer has it?
Usually not, and it is the last thing to do rather than the first. A new number does nothing about the accounts that still trust the old one, and the old number stays on every list it was already on. Change it only if calls and texts continue after you have blocked, reported and stopped answering, or if your number was actually moved to another SIM and your carrier cannot restore it cleanly. Before that, lock the number at the carrier, take SMS out of your two-factor settings, and let the calls go to a voicemail with a password on it. The number is not the asset. What it can reach is.
How does a scammer get my phone number in the first place?
From lists. Numbers leak in data breaches, sit on people-search sites, are scraped from social profiles and sold by data brokers, and every number that once answered a scam call is resold as a confirmed live lead, which the FTC calls a sucker list. Nothing on the number tells them who you are; the lists do. That is why the first call is usually a probe. A recording asking you to press a key to stop the calls, in the FCC's words, is a trick scammers use to identify potential targets. Answering, pressing or calling back moves you up the list.
What should I do with the scammer's phone number?
Report it and forget it. Forward a scam text to 7726, report the call or text at ReportFraud.ftc.gov and, if the caller ID was faked, file a complaint with the FCC, then block the number on your phone. Do not call it back, do not text it, and do not pay anyone who offers to trace it, unmask it or use it to recover your money. The number you see is very often spoofed and belongs to a stranger, and the people who sell tracing to scam victims are running the recovery scam, aimed at the same person twice.