Find Anyone's Phone Number Using Facebook

Facebook wants your phone number, nagging you for one as soon as you join. This is not all bad since it can help secure your account with two-factor authentication. On the other side, this makes it easy to reveal the private phone numbers of virtually anyone on Facebook, including celebrities and politicians. We are going to check out at how a hacker would do that and how to guard yourself.

Many Facebook users might not even realize that their private phone number is connected to their Facebook account, having forgotten that they did so. Facebook isn't allowed to easily extract your number from your phone, but they treat repeatedly asking you to verify and save your number at a regular interval when you launch Facebook.

The default privacy setting on Facebook allows anyone to look for you by your phone number once you add it. This is not a new issue. It has been around as long because of the Facebook search, but Facebook chooses to ascertain this issue as a feature, as a letter received by Belgian researcher Inti De Ceukelaire shows.

Certainly, some people, like celebrities and politicians, should be more concerned than others about revealing their private number online. Once a hacker has a telephone number and your name, they will quickly use open-source intelligence (OSINT) tools to grab further public data like occupation, employer, spouse, relationship, and other public information.

A hacker could use the knowledge to further social-engineering attacks by calling you directly. Consider the Bank scams in the whole world, only the caller trying to trick you know your name and intimate details of your personal life. Armed with these, it is easy to make the target think the caller is legitimate.

How would a hacker actually set about finding your number? In theory, if they had a lot of time, they could just search all 9,999,999,999 potential numbers until they stumbled upon yours. Clearly, this is not very efficient, so let's examine the proper way of doing it.

Step 1: Use the Area Code

Let's take an example: +91-99-114-83207. Looking at the MTNI (Mobile telephone numbering in India), here +91 is the country code, 99 is the operator code (for Idea cellular limited), 11 is the area code (for Delhi), and eventually, 483207 is the subscriber id. For more information visit :

we can see that the primary four numbers (9911) are the area code. This information right there eliminates one billion possible numbers from the hacker's list.

Step 2: Get the Last Numbers

Now, I do know my target's number is 99-11?-?????, I would like to undertake and take away as many of these question marks as possible, making it easier to do a Facebook search afterward. Thankfully, Facebook provides a feature to find out 2 digits of the number. In order to get the last two numbers, we just need to go a couple of steps into the password reset process.

The person which I have chosen for testing is Muriel Bowser (US resident), her number was changed to protect her real number.

To do this, the hacker goes to the main Facebook page and clicks the "Forgot account" to start the process.

Next, they enter the target's name they have in mind and click on the "Search" button.

The hacker is then presented with an inventory that has a face picture paired with each matching account that helps them quickly identify their target. There's our target right at the top!

Facebook then kindly provides the hacker the last two digits of the target number, along with some information about the email accounts associated with their Facebook account, like the first and last letter, and sometimes the email domain.

That's as far as the hacker has to go. They do not actually reset the password, and they shouldn't so that the target never receives any kind of notification to tip them off.

Step 3: Use Outside Sources

With over 218 million users, PayPal and other services can help increase the information the attacker has collected so far. During this case, if the target may be a PayPal user, the hacker can get two additional digits of the phone number we are trying to find.

We can also use Truecaller to verify and find out the targeted victim. It is the simplest and best alternative for Paypal searches for Indian Numbers.

Google accepted it, but that does not necessarily mean that it's the target's email. The hacker can check by doing an equivalent password reset trick they pulled with Facebook.

Yeah, this account exists to have a number that ends in 69. Coincidence? I think not. Now that I have an email to work with, I can jump over to PayPal in a new tab, and once again, use an equivalent password reset trick.

This time, once I get to the password reset screen, I will not only get all four digits of the line number but also the first number of the area code too!

This allows me to be reasonably sure that I'm on the proper track with the area code, and verifies my previous work on finding the last few numbers. This means I have the number 202-???-6969 thus far. In other words, my list has gone from 10 billion choices to a couple of thousand in only a few minutes of labor.

Step 4: Brute-Force It the Smart Way

At this point, a hacker could just start throwing numbers into the Facebook search bar, but that still would not be that efficient. So what does a lazy hacker do? They take advantage of a Facebook feature that permits you to conduct a bracket search.

Facebook allows you to upload lists of contacts in CSV format, and then tells you if they exist on Facebook or not so you can add them as friends. By constructing my very own contact list of potential numbers, I can quickly rule out large chunks of wrong numbers.

In this case, I do know the number has to be in the range from 202-000-6969 to 202-999-6969. By cutting that in half and creating an inventory of numbers from 202-000-6969 to 202-500-6969, I can effectively rule out half my list, because the target will only be in one among the two half lists created. Then, I can upload the list and instantly determine if they are on the uploaded list or not.

To create this list, I went to Google Contacts and clicked "Export" to get a sample CSV file to work from.

Facebook prefers to simply accept the list in Google CSV format, so I saved it as such from Google Contacts.

From there, a hacker can open the file in Google Sheets or Excel and change the column formula for the phone numbers to one that will iterate over the numbers they need to check, as seen in the following example.

In the excel formula below, I start by taking the lowest value phone number, in this case, 2020006969, then I add 10,000 to it in order to increase the fifth place digit by 1. This formula will repeat as many times as needed, but we shouldn't do it more than 1,000 times because there are only a thousand numbers in our list to guess. If the target hadn't had a PayPal account to help us derive the third and fourth place digit, then we might be adding 100 to extend the third digit instead.

👉=(ROW()*10000) +2020006969

From there, it is simple to sign into a Facebook account and go to the Friend Finder feature. Click on the Gmail and then click on "Find Friends."

Next, scroll to the bottom of the page and upload your CSV file containing the phone numbers you would like to try.

After it is uploaded, Facebook presents the hacker an inventory of "Friends" to add from the list. They might then look for their target inside that list. My target doesn't seem to be here, so I do know they are not during this half of our batch of numbers.

Next, rather than testing the next 500, I split the subsequent 500 in half and check one among those halves. This is because I already know the target will be on the second list since they weren't in the first half. The hacker can continue searching in this way until the target appears on a phone number list.

From there on out, the hacker would test smaller and smaller batches of numbers until they have only a handful to test manually. I stopped once I had it down to about 30 numbers only. Obviously, this may take longer if the hacker has less information about the other digits of the phone number, to start with, as they will have a larger number set to search from. Facebook will rate-limit the hacker to 5 attempts per day but they can bypass this by signing into another account.

Step 5: Test the Last Few Numbers

Once that hacker has it down to a handful of numbers, they then go to the Facebook search bar and type them in one by one. If the requests are going too fast, or if they look for too many, Facebook starts to rate-limit them with a CAPTCHA code.

However, that's not much of a defense when the hacker only has 30 numbers to check.

In total, it took around 30 minutes to an hour to seek out the target's number, and the same steps might be used on anyone who has their phone connected to Facebook.

Step 6: Protect Yourself

The simplest way to protect yourself is to never connect your phone to Facebook. If you still want to use two-factor authentication, Facebook allows you to use a USB U2F device without having to depend on your phone.

If you have got your phone connected, navigate to Facebook Settings, select "Privacy," then "Who can look you up using the phone number you provided?" Set this feature to "Friends." Unfortunately, Facebook does not allow you to set this to "Only me."

While this still will not provide absolute protection, it will make the hacker far more difficult to seek out your personal phone number.

If you like this article, share it with your friends.

Stay tuned and do subscribe for the latest hacking tips and tricks.

Sunday, August 21, 2022

Find Anyone's Phone Number Using Facebook