How a Bug Let Hackers Uncover Your Google-Linked Phone Number

Imagine someone could figure out your private phone number just by guessing it—digit by digital guess—without even notifying you. That’s exactly what happened to Google users, thanks to an overlooked loophole recently discovered and fixed.

According to Android Authority, a security researcher (going by “Brutecat”) dug into Google’s account recovery tools and found a way to exploit them. While these tools are meant to help users who’ve locked themselves out, Brutecat realized that one page didn’t require normal anti-bot protection. 

That allowed a brute‑force attack—essentially guessing each number combination fast enough to arrive at your full phone number in under 20 minutes (sometimes as little as 4 minutes).

So, how did this work? It involved a clever two-step trick:

• First, the attacker used Google’s Looker Studio tool to figure out someone’s display name—a key clue tied to the account.
• Then they used the recovery form to reveal the last two digits of the user’s phone number. Armed with that, they ran automated guesses until they hit the full number.

And the worst part? Google didn’t alert users during the process. The victim wouldn’t know until the full number was exposed.

Why this matters

Your phone number is often used for two-factor authentication (2FA). With it, a hacker can trick your mobile provider into transferring your number to their device—a nasty tactic called “SIM swapping.” Once that happens, they can receive your password reset codes, access your email, bank apps, even crypto wallets.

Google recognized the problem once Brutecat reported it this April. They evaluated the exploit as somewhat risky, patched the loophole in late May, and rewarded the researcher with a $5,000 bug bounty.

In their fixing update, they disabled the vulnerable account-recovery route and reinforced protections.

What you can do

While you didn't do anything wrong, this incident is a good reminder to take security precautions:

• Avoid relying solely on your phone number for 2FA. Use authenticator apps (like Google Authenticator or Authy) or physical security keys.
• Check your account's recovery options in your Google Account settings—make sure everything looks correct.
• Stay informed on security updates. When companies patch flaws like this, it’s worth reviewing your settings and strengthening your defenses.

This bug didn’t lead to a massive data leak—Google caught it before that—but it does highlight just how sensitive simple data like phone numbers can be. Luckily, the hole is now closed, and there are steps you can take to sleep easier.

Source: Android Authority