Google is silently linking phone numbers across accounts — the privacy risks and how to stop them

As you may have heard from the news, Google now attaches your phone number to all accounts signed in on your Android device without notifying you beforehand. This isn’t a new feature — it has been enabled by default since the September 2025 Google Play services update, but it’s only now that users are taking notice.

A quick word on what’s really happening: when you add a phone number to a Google account, Google automatically adds that number to other accounts on the same device. Google’s purpose is probably to improve account recovery and enhance accounts’ anti-abuse measures. However, a surge in discussion around this feature has prompted me to examine the privacy and security threats that may come with it, before offering steps to double-check your Google Account security.

The hidden cost of convenience

The issue here is that Google phone number verification takes place without users’ prior consent. This means they may not even realize their phone numbers are being linked across accounts they intend to keep separate. Many of us use different accounts for various purposes: one for work, one for personal use, one for sensitive or extra services, and so on. This number verification links these separate digital identities to a single real-world person.

In such situations, the phone number can become a single point of failure. If scammers have access to users’ SMS — for example, through SIM-swapping attacks — they can compromise the accounts by requesting password resets and receiving verification codes. Although SIM access alone is often insufficient to reset a password, SIM-swapping can now become a viable entry point for widespread attacks. Please note that this isn’t about condemning carrier security practices, and that Google also recommends Google prompts instead of text message verification codes.

Even when there are no attacks, this is a matter of privacy and self-determination. Many users may not want their work, personal, and anonymous identities automatically connected in this way. Setting aside those who use multiple accounts for bad intent, others may simply want identity separation for privacy and comfort when making transactions or joining a conversation.

I’m not pointing fingers — Google officially announced the change, and perhaps it just attempted to facilitate password recovery through broader cross-account linkage.

Yet there are unforeseen variables in the landscape. A phone number may be used by various users over time, such as when parents pass a number down to their child or when a carrier recycles an abandoned line, which poses risks of unintended identity merging. There would also be unnecessary complications associated with device sharing and managing company numbers or devices. Links formed within the system may not disappear just because users change their phone numbers or temporarily suspend their accounts, and some users may not know which connections persist and for how long.

Simply put, many of us don’t want our personal information or data about our preferences to be linked and exposed to such an extent. When an attack or failure occurs, it is difficult to find a one-size-fits-all rule to hold a certain party accountable in the absence of a clear regulatory framework.

How to take back control

Fairly stated, this is not an alarming security loophole — it’s just that users have the right to ask for consent, particularly in account management matters. Double-checking your Google account security is pretty straightforward, and you can go so far as to keep your accounts as separate as possible with Android’s advanced features.

Below are things you can do to turn off automatic phone number verification and review your active linked phone numbers. Further optional steps to improve your overall device security will also be included.

Step 1: Open the Settings app, tap on Google (or Google services), then switch to the All services tab. Navigate to Phone number verification under the Privacy and security section and toggle off Verify phone numbers automatically.

According to some of our readers, disabling phone number verification doesn’t persist; the toggle is back on after a while. I haven’t encountered this situation, but let’s hope future fixes ensure that no one runs into issues with their preferred settings.

Step 2: If you want to perform a phone number audit, tap your Google Account profile in the same interface (which shows your name, email address, and profile photo), then select Manage your Google Account. You can also go to myaccount.google.com on your phone or computer to do the same.

Select Personal info and remove any phone numbers that are not yours or not in use. On the Phone number interface, check whether your phone number is linked to devices you don’t recognize and remove them.

Step 3 (optional): As you’re at it, take a quick look at the other sections to review your sign-in sessions in Security and sign-in, manage app data sharing in Linked apps, and so on. It’s optional, but this is an opportunity to audit all your sync settings and subscriptions.

Step 4 (optional): You can switch from SMS 2FA to Google Authenticator or passkeys to reduce the risks of SMS-based attacks. To do this, in the Security and Sign in interface, tap 2-Step Verification and set up Google Authenticator or Passkeys following the on-screen instructions.

Step 5 (advanced): To completely separate your Google accounts, you can set up multiple users on a single device — but note that this is for security enthusiasts. With automatic phone number verification disabled, this step provides additional protection by isolating one account’s digital footprint from another’s, reducing the risk of future cross-account attacks.

To do this on a Pixel, navigate to Settings > System > Multiple users, turn on Allow multiple users, and tap on Add user to set it up.

On a Samsung Galaxy, you can use Secure Folder, which functions differently but also lets you sign in with a separate Google account in an isolated environment. Locate Security and privacy in your Settings app, choose More security settings, and tap on Secure Folder to start configuring it. The Secure Folder app will appear on your Apps screen for instant access.

In my experience, this setup scatters certain workflows, forcing me to go back and forth between different users/ folders. Keep that in mind if you’re about to add a new device user yourself.

Ultimately, I have to repeat that Google’s automatic phone number verification is intentionally a feature rather than a security flaw. But somehow, it has become another thing to take care of or worry about amid a lengthy list of things to protect on our devices.