Google Automatically Adds Phone Numbers to All Android Accounts by Default
Android users report that Google links their phone number to every account on their device, merging identities they intended to keep separate.
Key points
- Google enables phone number verification by default on Android devices.
- The feature adds the device's number to all signed-in accounts automatically.
- Users must manually disable the setting and remove numbers from secondary accounts.
Google automatically associates the phone number of an Android device with every Google account signed in on that phone, according to research published by Malwarebytes Labs. This default behavior links secondary accounts to a user's primary identity without explicit consent or notification.
The issue arises because Google’s own documentation confirms that phone number verification is enabled by default. When this setting is active, the system adds the device’s phone number to all existing accounts and any new accounts added to the device later, regardless of the user’s intent.
Context and Background
Android Central reported that users received unexpected emails notifying them that their phone number had been verified for secondary Google accounts. These notifications surprised users who maintained separate accounts for work, personal use, or other private activities, expecting those identities to remain distinct.
Google states that phone number verification supports features such as signing in, account recovery, Rich Communications Services (RCS) messaging, and locating lost devices. However, this convenience comes at the cost of privacy for users who rely on account separation to compartmentalize their digital lives.
Who Is Affected
If a user deliberately left their phone number off a secondary account, this automatic linking connects that account to their real identity without their knowledge. While the phone number does not become public, Google gains another method to connect accounts that the user intended to keep separate.
Malwarebytes Labs noted that this behavior mirrors previous issues where Google Play sign-ins allowed tracking of another person’s movements via Google Maps Timeline. In that case, an account remained linked to a device even after the user logged out, highlighting persistent challenges in managing device-based account associations.
What should you do?
Users who wish to prevent this linking must manually adjust their settings. First, they need to turn off automatic phone number verification on the Android device itself. This prevents future accounts from inheriting the number but does not remove numbers already added to existing accounts.
To remove the number from secondary accounts, users must inspect each account individually via a web browser. They should visit myaccount.google.com, navigate to Contact info, and select Phone. From there, they can review and delete the listed number for each account they wish to keep separate.
What to do and how to stay safe: Google
- Disable automatic phone number verification in the Google services settings on your Android device to stop future automatic linking.
- Log into each secondary Google account via a web browser and manually delete your phone number from the contact information section.
- Review 2-Step Verification and recovery phone settings separately, as these services may retain the number even if removed from the main profile.
- Check individual Google service settings for any additional phone number configurations that may not appear in the main account dashboard.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does Google notify users when it adds their phone number to an account?
Android Central reports that users received unexpected emails after their numbers were verified for secondary accounts, but the process happens automatically by default.
Does turning off automatic verification remove existing numbers?
No, Malwarebytes Labs states that turning off the verification switch does not remove numbers already added to your accounts; you must delete them manually.
Is my phone number made public by this feature?
No, the source material states that your number doesn’t automatically become public, but it allows Google to connect accounts you wanted to keep separate.
