Now we should point out that your complete phone number isn’t streaming out in a way that anyone can grab it. What is being sent is a couple of bytes of the “hash” of your number everytime you hit share. Hashing is a form of cryptography that takes data and converts it into a unique string of text. Those interested in stealing your number could have all of the hashes of a phone number in a particular region, based on area code. After all, each area code has a limited number of options. But that makes it possible for an attacker to figure out your phone number from just a few bytes of “hash.”

Hexway actually has a scenario on video that shows how someone on a subway or near other iPhone users can employ a laptop to capture the “hash” sent by an iPhone user attempting to use AirDrop. The number is figured out using the aforementioned database and the person’s name can be discovered using the Truecaller app or from the name of the device (ex. Joe’s iPhone). With that information, an iMessage can be sent to the unsuspecting iPhone owner.

AirDrop and Bluetooth LE could be giving away your phone number and Wi-Fi password

To protect yourself, the only thing you can do according to Hexway, is turn off Bluetooth on your iPhone. You might not be able to use AirDrop or some of the other features, but if you want to make sure that what happens on your iPhone stays on your iPhone, you will have to give up some features of convenience.