Skip to content
HackIndex logo

HackIndex

Reverse Phone Search Techniques

4 min read Apr 11, 2026

Overview

Reverse phone search attributes a number to a real name, address, or organisation using public records, data broker aggregators, and open source sources. The goal is to move from a number to an identity. Results vary significantly by country: US and UK numbers have the deepest public coverage, while numbers from countries with stricter data protection have far less available.

Search Engine Queries

Before using any API or paid service, run the number through search engines directly. Numbers posted in forum signatures, classified ads, business listings, social profiles, and contact pages are indexed and often the fastest path to attribution.

Format the number multiple ways since the same number may appear differently across sources:

+447911123456
07911123456
07911 123456
+44 7911 123456
(+44) 7911 123456

Run each format as a quoted search. Add context terms if you have them:

"+447911123456"
"07911123456" site:linkedin.com
"07911123456" "contact" OR "call" OR "whatsapp"
"07911123456" filetype:pdf

True Caller

Truecaller aggregates caller ID data from users who have installed the app and granted access to their contacts. It is one of the largest crowd-sourced phone databases globally and covers mobile numbers in India, the Middle East, and parts of Africa particularly well.

Search via the web interface at truecaller.com or query the API if you have access. Results include the name stored for that number across millions of contact books, which is often a real name even for numbers the owner has not publicly associated with their identity.

Data Broker Sources

For US numbers, people search sites aggregate public records, voter registrations, property records, and commercial data into searchable profiles. These sources frequently return names, addresses, and associated email addresses for mobile and landline numbers.

Useful US-focused sources:

  • Whitepages — strongest coverage for landlines and registered mobile numbers

  • Spokeo — aggregates social, commercial, and public record data

  • BeenVerified — broad people search with phone as a primary search key

  • TruePeopleSearch — free, no account required, US public records

For UK numbers:

  • 192.com — UK electoral roll and directory enquiries data

  • BT Phone Book — listed landline numbers

  • Companies House — business numbers registered against director contact details

Several platforms allow searching by phone number or use a phone number for account recovery in a way that confirms account existence. These checks are platform-specific and change as platforms update their privacy settings.

Facebook historically allowed searching accounts by phone number through the search bar. This was restricted but the password reset flow still confirms whether a number is registered:

  • Go to the Facebook login page and select Forgot Password

  • Enter the phone number in the search field

  • If an account is found, Facebook displays the partially masked email and name associated with the account

The same password reset technique works on Instagram, LinkedIn, and Twitter to varying degrees depending on current platform configuration.

Google Maps and Business Listings

Business phone numbers are frequently indexed in Google Maps, Yelp, TripAdvisor, and other directory services. Searching the number directly in Google Maps may return a business name and address instantly if it is a registered business number.

┌──(kali㉿kali)-[~]
└─$ curl -s "https://maps.googleapis.com/maps/api/place/findplacefromtext/json?input=$PHONE_NUMBER&inputtype=phonenumber&fields=name,formatted_address&key=$GOOGLE_API_KEY" | jq '.candidates[]' 
{
  "name": "Example Business Ltd",
  "formatted_address": "123 High Street, London, UK"
}

Breach Data

Phone numbers appear in breach datasets alongside email addresses, names, and other identifiers. Run the number through Intelligence X and similar breach search platforms. A phone number found in a breach record alongside an email address is a strong attribution link and both identifiers can then be pursued independently through their respective workflows.

Interpreting Results

Results from data broker sources should be treated as leads rather than confirmed facts. Records can be stale, attributed to a previous owner of the number, or aggregated incorrectly. Cross-reference any name or address returned against other sources before including it in an intelligence product. A name that appears consistently across multiple independent sources carries significantly more weight than a single data broker result.

References