except as a spam impedence (not prevension) requiring phone numbers is a legitimate security and privacy risk, especially for people who think it is a stable and unique identifier