To investigate a phone number, first normalise it to international format and read what the digits can tell you: the country, often a region, and sometimes the type of number. Then find out what kind of line it is today and whether it has moved between carriers, work out how long it has belonged to its current holder, and only then search for where it appears: breach records, listings, filings and accounts. Treat each result with care, because phone numbers are ported, shared and recycled, and the person holding a number today is often not the person attached to its oldest records.
What a phone number can and cannot prove
A phone number feels like a strong identifier. It is short, it is usually verified at signup, and most people keep one for years. For an investigation it has weaknesses that an email address mostly does not.
A number can move between carriers, and from a mobile network to an internet phone service, without its digits changing. Household landlines, office lines and shared work phones put several people behind one number, and on a family or company plan the account holder is often not the person who uses the line. And numbers that are given up go back into the pool and are issued to someone else, often while the old owner's accounts still point at them.
So every finding needs a date, and every link to a person needs a second source.
Question one: what do the digits say?
Start by writing the number in E.164 format: a plus sign, then the country code and the national number, with no spaces or punctuation. E.164 is the ITU's international numbering plan, and it specifies at most 15 digits, one to three of them for the country code, though some valid numbers in Germany are longer. Normalising first matters for the same reason it does with email addresses. One number written as (312) 555-0148, 312.555.0148 and +13125550148 looks like three different values in a spreadsheet until someone converts them.
The country code is a broad filter. The United States, Canada and several Caribbean islands all share +1. And as the FAQ of Google's open-source phone number library puts it, many people have phone numbers that do not belong to the country they live in, particularly mobile numbers.
That library, libphonenumber, is widely used for this step, and Android has used it since version 4.0. It parses, formats and validates numbers and can often tell you the type of number from the digits alone. Its documentation is careful about the limits, and they are worth knowing:
- A valid number is one from a range that carriers can assign. The FAQ says not to rely on the library to tell you whether a number is currently assigned to anyone or reachable.
- In some countries, including the US, mobile, landline and most internet phone numbers come from the same ranges, so the digits cannot tell you which one you have. The library reports those as fixed line or mobile.
- Where it has carrier data for a country that allows porting, it returns the carrier originally assigned the number, which may not be the one serving it today. For US numbers it has almost none.
So the digits give you a country, a rough region where the numbering plan is geographic (in the US, for mobile and landline numbers alike), and sometimes a type. They do not give you a person, and they do not tell you what network the number is on now.
Question two: what kind of line is it now?
For that you need a lookup against current carrier data, which commercial number lookup services provide. The result usually gives the carrier serving the number today, often the carrier that originally held it, and a line type: mobile, landline, internet phone or something more specialised.
Portability is why this is a separate step. The FCC's consumer guide explains that people who switch providers while staying in the same area can keep their number, including moves between landline, internet and wireless providers. When today's carrier differs from the original one, the number has most likely been ported, unless the original carrier has since merged or rebranded.
| What the line looks like | What it suggests | What it does not tell you |
|---|---|---|
| Mobile | Served by a mobile carrier, usually on a phone plan | Who holds it now, or since when |
| Landline | Served by a fixed-line carrier, often a home or office line | That the line is at the address you expect |
| Internet phone number (VoIP) | Can often be set up and dropped quickly | That anyone is hiding anything, since plenty of people and businesses use them |
| Toll-free or premium rate | A business or service line | Anything about an individual |
| Invalid or unassigned range | A typo, a formatting error or an invented number | Intent |
An internet phone number is easy to over-read. Some can be set up online in minutes, which suits a throwaway identity, but on its own the line type proves nothing.
Question three: whose number is it now?
This question decides whether the rest of the evidence is about the right person.
Numbers are reissued on a large scale. Researchers at Princeton who studied number recycling cite an FCC estimate of around 35 million US numbers disconnected every year. Of 259 numbers on offer to new subscribers at two major carriers that they identified as probably recycled, 171 were still tied to existing accounts at popular websites.
So old records attached to a number may belong to a previous holder who has nothing to do with your case. Contact data goes stale the same way: a database that once matched a number to a named person can go on listing that person long after the number has passed to someone else.
Date everything. For each record that mentions the number, note when it was created and what name or account it points to. If the records split into an older cluster under one name and a newer cluster under another, you are probably looking at two holders, and only one of them is in your case.
Question four: where does it appear?
Now search, with the number in each of its common formats.
Breach data can date a number. The Facebook data scraped in 2019 and leaked in 2021 is a good example: Have I Been Pwned lists it at 509,458,528 accounts, every record in it included a phone number, and only 2.5 million included an email address. Facebook said the data was scraped before September 2019, so, by Facebook's own account, any number in it was on a Facebook profile before then. Have I Been Pwned no longer takes phone numbers in its website search, but its API still supports them, so a number can be checked without handling the leaked file. Use a breach hit to date a number, not to name its holder. A name in a leaked record is unverified, and it may belong to an earlier holder.
Public listings are the other rich source: classified ads, rental and vehicle listings, business directory entries, company filings, and the contact details people once published themselves on forums and personal sites. A number that appears in listings under several different names in a short period is a much stronger signal than any line type.
Your own platform counts as well. The same number verifying several accounts, or appearing in several sellers' listings, is a link between them, with the caveats in our guide to linking related accounts.
A worked example
The case below is a composite, and the number in it comes from the 555-0100 to 555-0199 range reserved for fiction, so it does not belong to anyone.
A dating platform's trust and safety team receives two reports about one profile. In both, the conversation moved to a messaging app within a day, and a few days later the profile asked for money to cover an emergency. The profile gives its name as Daniel, 41, an engineer in Austin. Its verified phone number is +13125550148.
The digits. A US number with a Chicago area code. The digits cannot say whether it is mobile or a landline. A Chicago number on an Austin profile is not unusual in itself, because people often keep their numbers when they move.
The line. A current-carrier lookup shows an internet phone provider, while the number was originally held by a mobile carrier. So it has probably been ported.
The holder. Two public records, a 2017 forum post and a 2018 business directory entry, list it under a woman's name in Illinois. Nothing ties it to anyone else until this year.
Where else it appears. Searching the number in its common formats finds two classified ads posted this year, one for an apartment to rent and one for a car, in two different cities, each asking for a deposit by bank transfer. One is signed Mark and the other Sam, and the car ad reuses a photo from Daniel's profile.
Put together, the number had an earlier holder, visible in records from 2017 and 2018, and has been used this year behind at least three names that ask for money, two of them tied together by the same photo. The woman in Illinois is most likely a previous holder rather than a suspect, and the report records her only as that. The team can act on the profile, look for other accounts on the platform verified with the same number, and keep an innocent person out of the case.
What to leave alone
Do not call or text the number. It tells the holder someone is looking, which often leads them to delete the accounts you were about to find, and with a recycled number you may be contacting someone who has nothing to do with the case.
Do not pose as someone else to get details from a carrier or from the holder. It can alert the holder, and anything learned that way is hard to stand behind in a report.
Do not run lists of numbers through messaging apps' contact discovery. Saving one number as a contact shows you whatever profile the holder chose to make visible, and that is ordinary use. Doing it in bulk is how the Facebook data was collected: Facebook said scrapers used software imitating its app to upload large sets of phone numbers through its contact importer and see which matched users. In a study published in 2025, researchers at the University of Vienna and SBA Research showed the same weakness in WhatsApp's contact discovery, confirming more than 3.5 billion accounts, after first reporting the problem to the company.
The innocent explanations
Most of what makes a number look suspicious has an ordinary explanation, and a fair report checks for it first.
Shared lines are common. A household landline or an office number reaches several people, so a name attached to it may belong to anyone in the house or on the team.
People keep their mobile numbers when they move, sometimes across states and sometimes across countries, so an area code that does not match a stated location proves nothing by itself.
A number with almost no public trace is normal for a new number, a new holder, or someone who keeps their details offline. See whether the email address or name it leads to has more history before drawing anything from the silence.
And a port or an internet phone line is context. Plenty of people change carriers to save money, and plenty of small businesses run on internet numbers, so neither counts against anyone on its own.
How Sixtyfour fits
Done carefully, the four questions take time, and in a busy queue the first name that turns up can belong to a previous holder.
Sixtyfour's agent starts from the number, researches where it appears across public sources, and returns each finding with its source. When a number turns out to belong to someone other than the person it was linked to, it says so, and it reports anything it could not establish as open. From there it can carry on from an email address or a name the number leads to.
Before you rely on a number
Normalise it and read the digits, check what kind of line it is today, date every record so that its holders separate, and only then search. Give each finding a date, confirm each link to a person with a second source, and mark what you could not establish as open.