What to do after your phone number or email is exposed

Finding your phone number or email online does not automatically mean the account was hacked. It may be an intentional public contact, an old profile, a people-search listing, a breach record, or evidence of an active takeover. The right response depends on which of those happened.

Secure any account showing unauthorized activity first. Removal from a search engine can wait; control of your email and phone number cannot.

Preserve the notice, source URL, timestamps, unexpected login alerts, and case numbers. Do not click a breach-notice link until you confirm the incident on the company's official domain or through independently found contact details.

Email is often the recovery channel for other accounts, so protect it before social profiles or shopping accounts.

1. Use the provider's official account-recovery page from a device you trust.
2. Change the password to a long, unique value. If the old password was reused, change it everywhere else it was used.
3. Sign out other sessions and remove devices you do not recognize.
4. Turn on multi-factor authentication. Prefer a security key or other phishing-resistant method when the provider supports one; an authenticator app is generally a better fallback than relying only on text messages.
5. Check recovery email addresses, recovery phone numbers, app passwords, and connected applications.
6. Inspect forwarding rules, filters, delegates, sent mail, and deleted mail for changes you did not make.
7. Tell contacts if messages were sent from your account, especially requests for money or links.

The FTC specifically recommends changing the password, signing out every device, enabling two-factor authentication, checking recovery information, and removing unknown forwarding rules after recovering an email account.

A public number creates spam and impersonation risk, but it does not by itself give someone control of the line. Loss of service, an unexpected carrier alert, or password-reset messages you did not request can indicate a SIM swap or port-out attempt.

Contact the carrier using its official website, app, store, or a number from a bill - not a link in the alert. Ask it to:

• confirm whether the SIM, eSIM, account owner, or carrier changed
• restore control if an unauthorized change occurred
• reset the carrier-account password and PIN
• enable its strongest available number-lock, port-lock, or transfer protection
• document the incident and give you a case number

After control is restored, change passwords on accounts that use the phone for recovery, revoke unknown sessions, and replace SMS-based authentication with a stronger method where possible. Review bank, card, payment, and email accounts for changes made during the loss of service.

Philippines. The NTC separates text-scam reporting from lost or stolen device blocking. Follow its reporting guidance for scam or spoofed SMS messages. IMEI blocking concerns a lost or stolen device; it is not a remedy for a phone number or email address that has merely been exposed.

A breach notice should say which categories were involved. Match the response to those categories:

• Email or phone only: expect targeted phishing and impersonation; secure the accounts and monitor for new exposure.
• Password or authentication secret: change it immediately everywhere it was reused and revoke sessions or tokens.
• Government identifier or financial data: follow the official identity theft response, monitor affected accounts, and consider a credit freeze or fraud alert where applicable.
• Medical, employment, or other sensitive records: follow the regulator and organization routes appropriate to that record type and jurisdiction.

In the United States, the FTC says credit freezes are free and must be placed with each of the three major credit bureaus; a one-year fraud alert can be placed through one bureau, which must notify the other two. If information is being misused, IdentityTheft.gov provides a recovery plan and letters.

Do not buy a monitoring product reflexively. First check whether the breached organization, your bank, insurer, or employer already provides it, which bureaus it monitors, how frequently it checks, and which kinds of misuse it cannot see.

If the identifier is simply published, work from the source outward:

1. remove or correct the source page or account field
2. opt out of the broker listing, if that is the source
3. request removal from search results under the engine's current policy
4. use an outdated-content tool after the source changes
5. monitor for a new URL or record

Google's Results about you can find and monitor supported results containing a home address, phone number, or email address. An approved search removal does not delete the source page, so complete both layers when possible.

California residents can use the state's Delete Request and Opt-out Platform (DROP) to send a single deletion request to over 600 registered data brokers. DROP launched January 1, 2026; data brokers must process requests starting August 1, 2026, and have up to 90 days to report initial status. The service is free and provides a DROP ID to track status.

DROP deletes non-exempt personal information collected from third parties, but exemptions include public records (vehicle or real estate ownership, voting records), information subject to investigation, HIPAA-protected health information, Fair Credit Reporting Act credit information, and Gramm-Leach-Bliley Act financial information. Results vary by consumer and may take time to notice.

Philippines. The NPC explains your right to access your own data and when you may request erasure or blocking. Retain evidence of the exposure and correspondence, and use the current complaint instructions for a privacy complaint. These rights do not guarantee removal of every public copy.

Once an identifier and context are public, a scam can sound convincing. Treat unexpected messages about a breach, delivery, payroll change, bank alert, or account recovery as untrusted until you verify them through an independent channel.

• Never share a one-time code with a caller or texter.
• Do not approve an MFA prompt you did not initiate.
• Open the company's app or type its known address yourself instead of following the message link.
• Tell family or coworkers about an impersonation attempt if their names or roles are being used.
• Preserve threatening or fraudulent messages before blocking and reporting them.

Scammers use technology to fake caller ID, making any name or number appear, including government agencies, known businesses, or your own number. Caller ID cannot be trusted. Hang up on unwanted calls, ignore unexpected texts, and ask your phone carrier about call and message blocking services. Reporting unwanted calls to the FTC helps enforcement, but does not guarantee immediate cessation of calls.

The FTC releases reported numbers daily to help companies block unwanted calls.

Usually, no. A unique password, strong MFA, secured recovery settings, carrier protections, filtering, and source removal are less disruptive. Changing the identifier also does not erase its old public history.

Consider a change when the account or number cannot be recovered, targeted harassment continues despite controls, or a safety plan calls for a new channel. Move critical accounts deliberately, keep the new identifier private, and do not publish a forwarding message that connects the old and new identifiers.

If an abusive person may monitor your device or accounts, use a safer device and seek a survivor-centered safety plan before making visible changes. The FTC notes that account or device changes can alert an abuser and that evidence may need to be preserved first.

For a wider inventory, use the public-data exposure audit. For source and index cleanup, follow the search-result removal workflow.