TL;DR — X (formerly Twitter) has a contact syncing feature that lets users discover accounts by phone number. If your number is attached to your X account and you haven’t disabled discoverability, anyone with your number can find your profile. This guide explains how the feature works, how to turn it off, and why some users register X with a virtual number to prevent phone-based discovery entirely.
Most people who add a phone number to their X account do it for security reasons — enabling two-factor authentication or having a recovery option if they lose access. What they may not realize is that adding a phone number also makes their account discoverable to anyone who has that number saved in their contacts, unless they specifically turn that off.
This isn’t a bug. It’s a deliberate feature that X calls “Discoverability.” Understanding how it works — and what the privacy implications are — is the first step to controlling it.
How X’s “Find Friends by Phone” actually works
X has two related but distinct mechanisms involving phone numbers and contacts:
Discoverability by phone number. When you add a phone number to your X account, a setting called “Let people who have your phone number find you on X” is enabled by default. This means: if User B has your phone number in their contacts and uploads those contacts to X, X will suggest your account to them. They don’t need to know your X username — just your phone number.
Contact upload and matching. Separately, X allows users to upload their phone contacts to discover which of their contacts are also on X. When a user does this, X compares the uploaded numbers against all accounts in its database. Any matches surface as suggested connections. The uploaded contact data is stored on X’s servers.
The interaction between these two features is what creates the privacy exposure: your number in someone else’s contacts, combined with your discoverability setting being on, means they’ll find you — even if they didn’t know you were on X.
Why this matters for privacy
Phone numbers are strong identifiers. Unlike a username, which you choose and can keep pseudonymous, a phone number typically traces back to your real identity — through carrier records, through the SIM registration you did when you got the number, and through the many services that know your number and your real name simultaneously.
Specific scenarios where this creates problems:
Pseudonymous accounts. Many X users maintain accounts specifically to separate their posting identity from their real name. An anonymous account for political commentary, a persona for creative writing, a pseudonymous professional presence. If that account’s phone number is in anyone’s contact list — an ex-employer, an old friend, a family member — discoverability can surface it to them.
Multiple account management. X’s rules technically limit users to one account per person, but many people maintain multiple accounts for legitimate reasons — professional/personal separation, different projects, testing. If both accounts share a phone number (or if your number is in the contacts of someone who searches X), the connection between accounts becomes visible.
Stalking and harassment protection. For people who use X while managing a safety concern, having their account discoverable by phone number creates an obvious risk. Anyone with the target’s number — from any context in their life — can locate the X account.
Data aggregation. Your phone number connected to your X activity creates a link in the data broker ecosystem. Companies that aggregate profile data can connect your Twitter history to your real-world identity more reliably once a phone number is the linking element.
Journalist and whistleblower sources. People sharing sensitive information publicly sometimes use pseudonymous X accounts specifically to avoid identification. Phone-based discoverability can undermine that protection if the number used is associated with their real identity.
How to disable discoverability on X
Turning off the setting is straightforward, and you can do it from the web or mobile app.
From the web (x.com):
- Click the three-dot menu (More) in the left sidebar
- Go to Settings and Privacy
- Select Privacy and Safety
- Scroll to Discoverability and Contacts
- Uncheck “Let people who have your phone number find you on X”
From the mobile app:
- Tap your profile icon → Settings and Privacy
- Privacy and Safety
- Discoverability and Contacts
- Toggle off “Let people who have your phone number find you on X”
The change takes effect immediately. Your account will no longer appear in contact-based suggestions for people who have your number.
How to remove uploaded contacts from X
If you’ve previously uploaded contacts to X — or if you’re concerned that the contact upload happened automatically when you granted the app contact access — you can request deletion:
- Go to Settings → Privacy and Safety → Discoverability and Contacts
- Look for “Manage Contacts” or “Delete all contacts”
- Confirm the deletion
This removes the contact data X has stored from your account. It doesn’t retroactively remove suggestions that were already made, but it prevents future matching from your upload.
Also worth checking: revoke X’s contact access at the OS level. On iOS, go to Settings → Privacy → Contacts and make sure X isn’t listed. On Android, go to Settings → Apps → X → Permissions → Contacts and revoke it there.
What the X data privacy research shows
In 2019, security researchers demonstrated that X’s contact upload feature could be used to systematically identify users. By uploading large databases of phone numbers, they could identify which numbers corresponded to X accounts — matching phone numbers to Twitter profiles at scale. X has since added rate limiting to the contact upload endpoint, but the underlying mechanism remains.
A separate incident in 2022 involved a vulnerability that allowed querying the X API with email addresses or phone numbers to retrieve associated account data. This affected millions of accounts and reinforced why using a number that can’t be traced back to you is worthwhile if account pseudonymity matters.
The point isn’t that X is uniquely irresponsible — these patterns exist across social platforms. It’s that phone numbers are a particularly strong identifier, and once they’re in a platform’s database, they can be used in ways that weren’t obvious at signup.
Why some users register X with a virtual number
The most complete way to prevent phone-based discovery is to register X with a phone number that isn’t connected to your real identity in the first place. If the number in your X account doesn’t appear in anyone’s contacts, the discoverability feature has nothing to surface.
A virtual phone number accomplishes this. When you verify your X account with a virtual number, the number attached to your account exists only in that context — it’s not in anyone’s address book, it’s not registered to your real name, and it can’t be traced back to you through normal lookup methods.
The process:
- Go to SMSCode and register
- Add balance — X verification starts at $0.005 for budget-friendly regions
- In the SMSCode dashboard, search for “Twitter” or “X” and select it
- Choose a country and get a virtual number
- Use it for X verification — the OTP arrives in your dashboard within seconds
- After verification, switch X’s 2FA from SMS to an authenticator app
Once you’ve switched 2FA to an authenticator app, the phone number in your X account is just a stored record — you can remove it entirely from Settings → Security and Account Access → Security → Two-Factor Authentication → Phone number, if you want to leave no number attached at all.
For choosing which country’s number to use, see how to choose the right country for virtual number verification. For general background on how virtual numbers work, what is a virtual number covers the fundamentals.
Comparing discoverability settings across platforms
X isn’t alone in using phone numbers for discovery. A brief comparison across major platforms:
| Platform | Contact sync default | Opt-out available |
|---|---|---|
| X (Twitter) | On when number added | Yes |
| Off by default | Yes | |
| Snapchat | On when number added | Yes |
| Always on | No (by design) | |
| Telegram | Optional | Yes |
| On when number added | Yes |
WhatsApp is the most aggressive — contact discovery is core to the product and can’t be disabled. X, Instagram, Snapchat, and Facebook all offer opt-out settings, though they’re not prominently surfaced during setup.
If you’re using virtual numbers across multiple platforms, the pattern is the same: use a number that isn’t in anyone’s contacts, and disable discoverability settings after signup on every platform.
What contact syncing doesn’t reveal
It’s worth being clear about what the contact-based discovery doesn’t do, because the feature is sometimes described in more alarming terms than warranted:
It doesn’t reveal your DMs or private posts. Contact-based discovery only surfaces your public account. It doesn’t give anyone access to your private content.
It doesn’t notify you when someone finds you this way. X doesn’t tell you when your account appeared in someone’s suggested connections.
It doesn’t work in reverse automatically. Just because User B uploaded contacts doesn’t mean X shows User B’s account to you. The discoverability setting is one-directional — it affects whether your account appears to others, not whether others appear to you.
It doesn’t affect who can message you. DM permissions are controlled separately under Privacy and Safety → Direct Messages.
Managing phone privacy across platforms
The phone-based discovery pattern isn’t unique to X. Instagram, Snapchat, WhatsApp, and Telegram all have similar contact-matching features. Each platform has its own settings for disabling discoverability. The common thread: if you’ve given a platform your real phone number and allowed contact access, that platform can build a social graph that connects your online identity to your offline contacts.
Using virtual numbers for accounts where you value separation — and disabling contact sync permissions at the OS level — closes the most significant vectors.
For how this works specifically on Snapchat, see creating a Snapchat account with a virtual number. For a broader overview of managing online privacy through SMS verification, see receiving SMS online safely in 2026.
FAQ
Can someone find my X account just by knowing my phone number?
Only if you have the discoverability setting enabled. By default, adding a phone number to X turns on “Let people who have your phone number find you on X.” If that setting is on, anyone who uploads contacts to X and has your number will see your account suggested to them. Turning the setting off prevents this.
Does X tell me when someone finds my account through contact syncing?
No. X doesn’t notify you when your account appears in another user’s suggested connections. There’s no way to see a history of who has been matched to your account through the contact syncing system.
If I remove my phone number from X, does my account disappear from contact suggestions?
Yes — once your phone number is no longer attached to your X account, it can no longer be matched against uploaded contacts. Note that previous suggestions that were already made won’t be retroactively removed, but no new matches will occur.
Can I use X without a phone number at all?
Yes. X doesn’t strictly require a phone number for basic account use. Some actions — like certain verification challenges or unlocking a locked account — may prompt for phone verification. But regular posting, following, and DMs work without a permanent phone number attached to the account.
Does using a virtual number prevent X from banning my account?
Virtual numbers don’t protect against X enforcing its terms of service. If your account is banned for violating rules — spam, harassment, platform manipulation — having a virtual number attached doesn’t prevent that. Virtual numbers are for privacy and verification purposes, not for bypassing platform enforcement.
Can X use my phone number to serve me targeted ads?
Phone numbers are a common input for ad targeting systems, including X’s. If your real number is in their system and matches records from data brokers or advertisers, it can contribute to ad profile building. Using a virtual number that isn’t connected to your real identity removes this vector, though X still targets ads based on your browsing behavior and content engagement regardless of phone number.