Where Robocallers Get Your Number (And How to Stop Them)

The robocall arrives at 11 in the morning. An unknown number, a brief pause, then a recorded voice offering something you didn’t ask for. You hang up. An hour later, another one. Different number, same script. By the end of the day you’ve ignored five calls from five numbers you’ve never seen before.

If you’ve ever wondered how they got your number — and why blocking one caller doesn’t stop the next one — the answer is more direct than most people realize. Your phone number is probably sitting on a website right now, visible in plain text, being read by automated scrapers that add it to databases, sell those databases to data brokers, and watch those brokers sell it again to anyone willing to pay.

The pipeline from your contact page to a robocaller’s dialing list is the same pipeline that delivers email spam and junk mail. Same infrastructure. Same brokers. Same compounding problem once the number is in circulation.

How Bad Is It?

The scale of the robocall problem in 2025 is genuinely staggering. According to YouMail’s Robocall Index, Americans received over 52.5 billion robocalls in 2025 — an average of more than 4.3 billion per month, or roughly 1,700 calls every single second of every day. That figure represents an increase from 2024 despite years of regulatory effort.

The U.S. PIRG Education Fund found that robocall volume in 2025 hit a six-year high, with monthly averages rising to 2.56 billion scam and telemarketing calls — up from 2.14 billion the previous year. Among those who lost money to phone scams in the first half of 2025, the Federal Trade Commission reported average losses of $3,690 per victim.

The reason volume keeps rising despite regulation is that the infrastructure feeding robocallers — the databases of harvested phone numbers — keeps growing. Blocking individual callers addresses the symptom. The number databases that feed the next campaign are untouched.

Where Robocallers Actually Get Your Number

There are several ways phone numbers end up in robocaller databases, but for business owners with a website, the most direct route is also the most overlooked one.

Your Website

If your phone number appears on your website in plain text — on your contact page, in your footer, on your about page — it’s being harvested. Automated scrapers crawl websites continuously, pattern-matching for anything that looks like a phone number. They don’t need to hack anything. They read your page source the same way a browser does, extract the number, and add it to a contact database that gets sold to data brokers.

This is the same mechanism that harvests email addresses and physical mailing addresses from the same pages in the same pass. A single scrape event captures everything visible on your contact page — phone, email, and address — and all three enter the same pipeline simultaneously. This is why business owners who start getting robocalls often notice simultaneous increases in email spam, junk mail, and spam texts. It’s not coincidence. It’s one harvesting event with multiple consequences arriving through different channels.

Data Brokers and People Search Sites

Once your number enters a data broker’s database, it doesn’t stay in one place. Data brokers sell contact records to marketers, call centers, and robocall operators — and those buyers may resell the data to others. Your number, harvested once from your website, can be in dozens of independent databases within weeks. Each one sells it independently to its own buyers.

People search sites — services like WhitePages and similar platforms that aggregate public information — compile and publish these records openly. Scammers scrape people search sites specifically to build calling lists, because the data is already aggregated and verified. Your number appearing on one of these sites is a direct feed to robocaller campaigns.

Public Records

Business registration records, professional licenses, court filings, and property records are public by design — and data brokers scrape government databases constantly. If you’ve registered a business, filed any public document that includes a phone number, or had your number appear in any public record, it’s likely already in multiple broker databases regardless of what’s on your website.

Previous Engagement

If you’ve ever answered a robocall, pressed a number to opt out, or interacted with a spam call in any way, your number gets flagged as “active and responsive” — which makes it more valuable and means it gets sold more aggressively to future campaigns. Robocaller lists distinguish between numbers that have shown any engagement and numbers that haven’t.

Why the Do Not Call Registry Doesn’t Help Business Owners

The National Do Not Call Registry currently has over 258 million active registrations. It doesn’t stop robocalls, and there are specific reasons why.

The registry applies to legitimate telemarketers — companies operating legally who are required to scrub their call lists against it. Those companies represent a small fraction of robocall volume. Scammers, political organizations, charities, and survey companies are either exempt from the registry or simply ignore it. The operations responsible for most of the 52.5 billion annual robocalls are not checking the Do Not Call Registry before they dial.

For business owners specifically, there’s an additional complication: your business phone number is often considered a commercial contact that falls outside the protections that apply to personal residential numbers. The registry was primarily designed to protect consumers at home from unwanted marketing, not to protect businesses from harvested-number campaigns.

Why Business Owners Get More Robocalls Than Everyone Else

Business phone numbers are more valuable to robocallers than residential ones for the same reasons business addresses are more valuable to junk mailers: they signal purchasing authority, they’re more stable over time, and they’re often easier to find.

A business that displays its phone number publicly — on its website, in directory listings, in Google Business Profile — is making that number available across multiple harvesting sources simultaneously. Each source it appears on is another point of entry into the data broker ecosystem. A residential number might appear in one or two places. A business number that’s been actively promoted might appear in dozens.

WordPress sites are a specific target because they follow predictable patterns. Contact pages, footers, and about pages are structured similarly across millions of WordPress installations. Scrapers built to harvest business contact information from WordPress sites know exactly where to look — and they find what they’re looking for at scale.

The Fix That Actually Works

Blocking robocallers addresses individual calls after they’ve already happened. The Do Not Call Registry addresses a subset of callers that’s not responsible for most of the problem. Neither approach touches the source.

The source is your phone number being harvestable from your website. Close that, and you stop feeding new campaigns. The lists that already have your number will continue to generate calls for some period — existing lists don’t disappear overnight — but the pipeline stops being fed. Over time, as your number ages on existing lists without new validation events, campaigns that prioritize fresh data deprioritize it.

Protecting your phone number at the source means it doesn’t appear in readable form in your page source. A visitor to your site sees the number exactly as they always have — they can click to call, they can read it and dial manually. But a scraper reading your HTML finds nothing harvestable. The number isn’t there in any form the scraper can extract and add to a database.

This is what WhoKnew Shield™ Pro does for phone numbers, alongside email addresses and physical addresses. Auto-detection scans your entire WordPress site — contact pages, footers, old posts, widget areas, page builder sections — and protects every instance it finds. The same encryption that makes your email invisible to scrapers applies to your phone number. And the Scraper Trap™ honeypot system catches bots probing your site and blocks them site-wide before they can harvest anything at all.

The free version covers email addresses. Phone number protection is a Pro feature — because the auto-detection required to find every instance of a phone number across a real WordPress site requires the deeper scan that runs in the Pro tier.

The Same Problem, Three Channels

It’s worth connecting the dots across the full picture: robocalls, spam email, and junk mail are not three separate problems. They’re three consequences of the same event — your contact information being scraped from a publicly visible source and entering the data broker ecosystem.

The scraper that reads your phone number from your contact page reads your email address and physical address in the same pass. All three enter the same databases. All three get sold to buyers who use them differently. The buyer who wants to run robocall campaigns purchases the phone data. The buyer running email campaigns purchases the email data. The direct mail company purchases the address data.

This is why protecting one piece of contact information in isolation — the approach most contact protection plugins take, covering only email — leaves the rest of the pipeline open. A WordPress site owner who has protected their email but left their phone number and address in plain text has closed one entry point into the data broker ecosystem while leaving two others wide open.

The complete approach protects all three simultaneously, automatically, and across every page of the site — not just the ones you remember to protect manually. That’s what makes the difference between patching a symptom and closing the source.

Who knew the robocall arriving at 11am on a Tuesday traces back to a contact page that’s been sitting unprotected since the site launched three years ago?