Skip to main content

Facebook loophole exposes private phone numbers, here’s how to close it

Security is one tough business, as it seems like every day brings a new flaw or vulnerability. Today’s finding is a big one, since it could impact nearly 1.5 billion Facebook users.

Reza Moaiandin, the technical director at the Salt Agency, discovered a flaw with Facebook that could allow hackers to figure out your phone number, even when it’s set to private. Here’s how it works, and how to protect yourself.

Recommended Videos

How it works

Facebook’s search box allows you to find potential friends on Facebook by simply typing their name, but many people don’t know that you can also enter phone numbers and receive results. If you think that setting your phone number to private will stop it from showing in search results, think again. Setting your phone number as private only stops it from appearing in your personal profile when non-friends are viewing it.

If we wrote a script and used Facebook’s API, we could have millions of phone numbers within minutes.

Facebook has an additional setting that allows anyone to search for you based on your phone number or your email address, and it’s set to Public by default. This means that anyone (friend or non-friend) entering your phone number in the Facebook search box will get information such as your name, location, and profile picture. That’s OK if the person actually knows your number, because they are most likely an acquaintance, a personal friend, or a family member.

The problem arises because a hacker can write a simple script with millions of phone numbers following a pattern for a certain area. They can then use Facebook’s API to conduct a search and get results within minutes. Imagine how devastating this would be for celebrities and politicians, especially since most people are using their mobile number exclusively these days.

To prove Moaiandin’s finding, we typed in a few phone numbers of non-friends in the Facebook search box, and bingo, the name of the person, location, and profile photo appeared for each number just like if we had typed their name. Of course, this method would be super slow since you would have to enter in each possible phone number, but it proves the flaw exists. If we wrote a script and used Facebook’s API, we could have millions of phone numbers along with who they belonged to within minutes.

What can Facebook do?

Moaiandin is advising Facebook to simply limit the amount of requests per user and detect patterns. This would be a good start, but encrypting data would be the best-case scenario.

He first contacted Facebook in April 2015 with his findings, but the first engineer didn’t understand the issue. After waiting a bit, Moaiandin notified the company again last month, and one engineer replied with, “Thanks for writing in. I investigated our codebase and it does appear to implement rate throttling. Note that the rate limits may be higher than the rate you’re sending to our servers, therefore you do not appear to be blocked. This is intentional. We do not consider it a security vulnerability, but we do have controls in place and mitigate abuse.” In other words, Facebook has some controls to prevent hackers from gathering mass phone-number lists, but they aren’t strict enough.

How to defend yourself in less than a minute

Good news! You don’t have to wait until Facebook wakes up and fixes this issue.

We contacted Reza Moaiandin and can confirm that if you follow the steps outlined below from either a desktop or a smartphone, your phone number will not be visible to hackers trying to use a script, or any random person who happens to enter it in the Facebook search field. We urge everyone to do this now, since it takes less than a minute to do.

From a desktop

  1. Open Facebook in your browser, click on the upside down triangle at the top right, and select Settings.
  2. Select Privacy from the left pane.
  3. Find Who Can Look Me Up under Privacy Settings and Tools
  4. Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
  5. You will also notice an option for Who can look me up using the email address you provided? You can change this as well if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.

From your smartphone

  1. In the Facebook app, tap on the hamburger icon (three lines) at the top right and find Account Settings.
  2. Tap on Privacy.
  3. Find Who Can Look Me Up under How You Connect.
  4. Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
  5. You will also notice an option for Who can look me up using the email address you provided? You can change this if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.

We will update this post when Facebook acknowledges the flaw and subsequently fixes it.

Robert Nazarian
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
There’s an easy way to follow election results on your iPhone. Here’s how
Screenshot of Apple News on an iPhone.

It’s Election Day in the U.S., and Apple is making it easier for people to check real-time results. The Apple News app will have a Live Activity feature that starts displaying results on your device as they come in tonight. The Live Activity on iPhone will appear on the Dynamic Island (if your iPhone has it) and the lock screen.

For the election, the Live Activity feature will provide up-to-date information, eliminating the need to refresh the Apple News app. You can expect results for the presidential, Senate, and House races to be posted.

Read more
Here’s how much the iPhone camera has changed in 10 years
A close-up of the iPhone 16 Pro camera.

The iPhone has always had a pretty decent camera. While Google prides itself on the photo capabilities of the Pixel, the iPhone has steadily improved with each iteration. Today, a user on Threads posted a side-by-side comparison showing just how far the iPhone camera has come in the last 10 years. We have to admit: it's pretty darn impressive, but perhaps even more impressive is how clear the iPhone camera's pictures were even 10 years ago.

Threads user @yantastic shared two pictures of the same location. One was taken with an iPhone 6 camera, while the other was taken with the iPhone 16 Pro Max.

Read more
Apple just launched the iOS 18.1 public beta. Here’s how it’ll change your iPhone
Someone holding an iPhone 15 Pro Max outside on a patio, showing the back of the Natural Titanium color.

This week is quickly shaping up to be a huge one for Apple fans. On Monday, Apple officially released iOS 18, watchOS 11, and macOS 15 to the general public. Tomorrow, regular sales begin for the new iPhone 16, iPhone 16 Pro, and Apple Watch Series 10. As if that weren't enough, Apple is now rolling out its first public betas with Apple Intelligence features.

Starting today, September 19, the public betas for iOS 18.1, iPadOS 18.1, and macOS 15.1 are available for anyone to download. The main draw to these public betas is that they all include Apple Intelligence features, which were previously locked to the developer betas for these software versions.

Read more