Android Phone Number Verification Links Every Google Account on the Device
Security / explainer
Android Phone Number Verification Links Every Google Account on the Device
Google's help page says the setting is on by default and can only be changed in device settings, and Kaspersky says the SIM identifiers it reads include ICCID and IMSI values.

Android's phone number verification, which Google's help page says is "turned on by default", adds each verified number to every Google Account signed in on the phone, including accounts and numbers added later. The setting lives in device settings, not in any individual account, so removing a number from one account does not stop the linking.
The feature is not new, but a Hacker News thread on Oct. 14 pushed it back into view, and the mechanics are worth setting out with their preconditions: who is affected, what Google collects, and what switching it off costs.
What Google says the feature does
Google verifies the number, or each number on a dual-SIM phone, during device setup, according to its Android help page. Google and the carrier "periodically" reverify, and carrier charges may apply. The page lists the uses: signing in with the phone, account recovery, Emergency Location Service, finding or locking a lost device, RCS messaging and video calls, and Quick Share.
The linking rule is the part readers react to. A new account links to all numbers on the device, and a new number is added to all accounts. A person who keeps a personal account and a work or family account on one phone therefore ends up with the same numbers attached to both.

How the check works and what it reads
Stan Kaminsky, writing on Kaspersky's official blog on July 22, describes two methods. The older one sends a hidden SMS to Google's servers, which the operating system usually intercepts, though a glitch can make it appear in the sent folder. The newer one sends an encrypted token containing device and SIM identifiers to the carrier, which returns the confirmed number within seconds.
Third-party apps can reach the result through Firebase Phone Number Verification, Kaspersky wrote. According to Kaspersky, Google says device identifiers and SIM data may be collected, including ICCID and IMSI values, which are the serial number of the SIM card and the subscriber identity the carrier uses. Google also says it does not sell personal information, including phone numbers.
Kaspersky dates verification to 2019 and says it became widely visible after a September 2025 system update. The Terminal could not open Android Authority's report, which the Hacker News thread links, so its claims are not relied on here.
What turning it off costs
The path on Google's help page is Settings, then Google, then All services, then Phone number verification under Privacy & security. Kaspersky adds a second setting, "Better sharing on Google", which turns on automatically with verification and is enabled for only one account when several are signed in. Changing it is per account, under Manage your Google Account, Personal info, Contact info, Phone.
| Feature | Effect of switching verification off |
|---|---|
| RCS in Google Messages | Stops; Kaspersky says chats stop about eight days after the SIM is removed |
| Quick number-based account recovery | Lost, per Kaspersky |
| Better sharing on Google | Separate toggle, per account |
| Sign-in with the phone, device location | Listed by Google as uses of the verified number |
Google's page says nothing about deleting previously collected numbers. Kaspersky says opting out does not guarantee earlier data is deleted, and that the setting can turn itself back on, with no reliable way to prevent that on standard stock Android.
What is not known
Neither page says how long Google retains the SIM identifiers or whether the linked numbers are used for ad targeting. Google's own page points to a separate article for how numbers are used, which The Terminal did not fetch. Kaspersky's concern is that with several accounts on one phone, the numbers become a link between identities that a user may have kept apart.
The practical instruction is to check the toggle on every phone that carries more than one Google account, and to decide whether RCS and quick recovery are worth the linkage. Other device-level privacy questions covered earlier include smart glasses that record bystanders and a hardware implant found in a Ledger wallet.
Sources
More in Security
- 01PyPI Wheels Carry Binaries Nobody Can Tie to Their SourcePython developer Artem Golubin argues that clean source can ship beside a malicious wheel, and the May 2026 TanStack incident shows a valid signature does not settle it.
- 02Microsoft Fixes 1,411 Flaws in October Patch Tuesday, One ExploitedThe Oct. 13 release is a record by BleepingComputer’s count, but three trackers report three different totals and the exploited bug needs a user to open a file.
- 03Broadcom Wi-Fi Bug Has No CVE and No Patch on Belgian GatewaysResearcher Quentin Kaiser says a WPS overflow in Broadcom’s SDK dates to at least 2010 and lets an attacker in radio range run code without the network key.
- 04Palo Alto Patches PAN-OS CVE-2026-0322 as Attackers Reach Management InterfacesThe flaw gives an authenticated administrator root on the firewall. Palo Alto lists no workaround, and CISA gave federal agencies three days.