Detection reference · Personal data · Updated 2026-11-03

Phone numbers

Phone numbers have no single format, so this rule is deliberately loose and runs after every stricter numeric rule (cards, IBANs, national numbers). Being loose has a cost, listed below as it is.

At a glance

Reported as	Phone number
Category	Personal data
Severity	medium: a personal identifier with real but indirect harm, such as an email, phone number or address
Replaced with	`[PHONE]`
Where it runs	The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks.
Engine rule	scanner.ts, line 246

What it looks like

An optional country code, an optional area code (with or without brackets), then two groups of 3 to 4 digits separated by a space or hyphen; 7 to 15 digits in total.

Example 1

You paste

Call me on +44 7700 900 123 after six.

Redaxa returns

Call me on [PHONE] after six.

Reported as	Phone number
Severity	medium: a personal identifier with real but indirect harm, such as an email, phone number or address
Replaced with	`[PHONE]`

Example 2

You paste

Our US line is (202) 555-0143.

Redaxa returns

Our US line is [PHONE].

Reported as	Phone number
Severity	medium: a personal identifier with real but indirect harm, such as an email, phone number or address
Replaced with	`[PHONE]`

All values on this page are synthetic or published specimens; none is a working credential or a real person's data.

In a repository check

The same example, committed to a public repository and run through the free repository check:

src/data/contacts.json: Phone number, listed for review (severity medium). Potential sensitive data. Context and authorization must be reviewed; this is not a confirmed vulnerability.
Same value in tests/fixtures/contacts.json: Test or example value, counted but not listed. Real-looking keys in test files are still reported.

Values are always shown masked in repository reports. No key is ever tested against its provider.

What it does not flag

Meeting at 12:30 on 2026-10-15: not flagged. Times and ISO dates are not phone-shaped.

Known false positives

Text that is harmless but still flagged today. Listed so you can recognise it, not hidden.

Order 2026 1015 shipped: flagged as Phone number. Two 4-digit groups look like a local number.
Invoice ref 4521-8890: flagged as Phone number. Same shape with a hyphen.

What to do

Remove the number or replace it with [PHONE]. In repository checks, number-shaped text without telephone context (CSS values, coordinates) is listed as a reference instead of an exposure.

Check before you paste

The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.

Add the Chrome extension Try a free web check

Sources

Redaxa engine: scanner.ts line 246. Every output on this page was produced by that code when the page was built.
Ofcom: Telephone numbers for use in TV and radio drama (07700 900xxx)