Android’s “phone number verification” setting is enabled by default and attaches the device’s verified phone number to every Google account signed in on that handset — including personal, work and throwaway profiles, and any account added later, according to Google’s support documentation. First reported by Malwarebytes Labs on October 20, the behavior has drawn criticism from users who deliberately keep accounts separate on the same device.
Google’s help page for managing the setting, updated on October 12, states plainly that verified phone numbers are added to all Google accounts signed in on the device, covering both current and future accounts and numbers. The company’s account help page, refreshed on October 20, repeats that any verified number for an Android device can be attached to any account signed into it.
Android Authority reported on October 14 that Google shifted its documentation between August and October 2025 so the feature became opt-out, silently linking a verified number across all signed-in profiles.
Why Google does it
Google says verification supports sign-in, account recovery, Rich Communications Services (RCS) messaging, locating or securing a lost device, emergency features and Quick Share. The setting also allows Google and mobile carriers to periodically re-verify that numbers still belong to the user.
According to Google’s Privacy Policy, a phone number added to an account can be used to help regain access if a password is forgotten, to help people find and connect with the user, and to make ads more relevant depending on settings. Google says it does not sell personal information, including phone numbers.
Who is affected
Anyone with multiple Google accounts on one Android device is affected — most notably users with both personal and work profiles on the same handset, where the feature can erode the separation they intentionally maintain. A WorkOS engineering post on October 19 cited the Android behavior in urging developers to stop treating phone numbers as primary identifiers.
No source reviewed describes malicious exploitation, threat campaigns or indicators of compromise tied to the feature, and there is no associated CVE or government advisory. The concern is privacy and account separation, not a security flaw.
What to do
- To stop future linking: open Android Settings, go to Google → All services → Phone number verification, and turn off “Verify phone numbers automatically.”
- Existing links are not removed by that toggle. Visit each account’s “Personal info” page, open the “Phone” section under contact info, and delete the number from any account where it should not appear.
- To stop others from finding you via the number across Google services, adjust the “Let people find you by phone number” control under profile discovery.
There are caveats. AndroidCentral and Firstpost reported on October 18 that users say the automatic verification toggle can switch itself back on after being disabled — a claim Google has not addressed.
For organizations running shared or BYOD Android devices, the practical advice is to audit which phone numbers are attached to which accounts and ensure work accounts have not inherited personal numbers, or vice versa. It remains unclear whether enterprise mobility management policies can granularly control the setting for managed work profiles.