Account verification codes: Which part of the telephone number do you show users?

Question

We will be asking our users to generate an account verification code that will be texted to them in order for them to sign in (as an alternative to emailing a password reset link). How many digits of the (mainly UK) telephone number can you show (so users can tell it's the right one), without compromising security? I have seen this on other sites:

07*****1234

Answer 1

A general principle to follow is to provide enough information for a user to identify the known phone number, while restrict others from any unintended use of it.

Most commonly, last two digits will be enough to recognize a phone number.

Let's have a look how a verification may be implemented.

Google provides just two last digits:

Yahoo shows two last digits, and the first one:

It is notable that Yahoo page itself named

"Phone obfuscation challenge"

that clearly reflects its purpose of hiding the phone number from an unwanted use.