There is no reliable way to turn a phone number into an email address on its own, and the methods most guides still recommend either stopped working years ago or were shut down by regulators.
What does work is different in kind: you use the number to establish who the person is and where they work, then find their business email through their professional footprint.
That path is slower, it is far more accurate, and it is the only version of this that survives a question from your legal team.
This guide covers what still functions, what does not, what the law actually requires before you send anything, and when the phone number you already have is the better channel to use.
Why phone-to-email lookup mostly does not work
Start with the structure of the data, because it explains everything downstream.
Email and phone number are both identifiers, but the commercial databases that connect them were almost never built from the phone side.
B2B data providers assemble records around a person and a company: name, title, employer, work email, sometimes a direct dial. The email is the anchor because it is the thing the industry sells outreach against.
The phone number is an attribute hanging off that record, not a key you can query in reverse with any confidence.
So when a tool advertises reverse phone lookup with email, one of three things is usually happening. It is matching your number against a consumer people-search database assembled from public records, which rarely holds current business email addresses.
It is matching against a crowdsourced contact database built from users who uploaded their address books, which raises consent problems covered below. Or it is guessing, and returning a plausible address it has not verified.
The tricks that used to work are gone
The single most-repeated tip in this category is to paste a phone number into Facebook’s search bar. That has not worked since April 2018, when Meta disabled search by phone number and email after acknowledging that, in the words of its then chief technology officer, most people on Facebook could have had their public profile scrapped this way.
The aftermath is the part worth knowing, because it explains why no platform has reopened this door. A dataset of 533 million Facebook records, heavy on phone numbers and names, was published on a hacking forum in April 2021. Meta attributed it to scrapping of the contact importer feature before a September 2019 fix.
Ireland’s Data Protection Commission opened an inquiry, and on 25 November 2022 imposed a fine of €265 million on Meta Platforms Ireland along with a reprimand and an order to remediate.
The scope of that inquiry named three tools specifically: Facebook Search, Facebook Messenger Contact Importer, and Instagram Contact Importer. The finding concerned data protection by design and default under Article 25 of the GDPR.
Once phone-number enumeration became a nine-figure regulatory liability, the incentive to offer it disappeared across the industry.
Any guide still describing that Facebook technique as a current method was written from older guides rather than from testing.
What each commonly recommended method actually returns
Method | What it actually gives you | Useful for B2B? |
|---|---|---|
Consumer people-search and reverse phone sites | A name, sometimes an address history, occasionally a stale personal email | Rarely. Personal addresses are the wrong target and the data is often outdated |
Crowdsourced caller ID apps | A name attached to the number, drawn from other users’ uploaded address books | For identification only. The consent basis for the underlying data is the sender’s problem, not the app’s |
Social search by phone number | Almost nothing on the major platforms since 2018 | No |
Contact syncing tools | Emails for people already in your address book | Only if you already had the contact, which means you did not need the lookup |
B2B data providers keyed on company and role | A verified work email, a title, a company, sometimes a direct dial | Yes, and this is the category that actually works |
Everything that starts from the number and moves outward returns weak data. Everything that starts from the person and moves toward the number returns strong data. That is not a limitation of any one tool, it is how the underlying records are built.
There is one important exception worth naming. If the number is a company main line or a published direct dial, it is often searchable in reverse simply because the business published it.
Searching the number in quotes will surface the company website, a directory listing, or a press release, and from there you are working with a business identity rather than a private one. That is a legitimate and frequently overlooked first move.
What the law requires before you send anything
This section is not a disclaimer at the end. In a prospecting workflow it comes before the tooling decision, because the answer changes which tools you are allowed to use.
GDPR: Legitimate interest, not consent, but with documentation
A work email such as firstname.lastname@company.com is personal data under the GDPR even though it is a professional address. That means you need a lawful basis to process it.
The good news for B2B teams is that consent is not the only option. Article 6(1)(f) provides legitimate interests as a lawful basis, and Recital 47 states that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. That is the regulation’s own language, not a loophole.
The catch is that legitimate interest is a test you have to pass and document, not a box you tick. The standard three-part assessment asks whether you have a genuine business purpose, whether email is necessary and proportionate to that purpose, and whether your interest is balanced against the individual’s rights and expectations.
The UK’s Information Commissioner’s Office publishes guidance and a template for this, and its position on B2B outreach is among the more permissive in Europe.
Three obligations follow from relying on legitimate interest. You must be able to say where you got the data. You must tell the recipient at first contact. And you must offer a genuine, immediate opt-out. If a prospect replies asking how you got their email, the answer needs to be a source and a date, not a shrug.
Rules also vary by country under the ePrivacy Directive, which lets member states set their own terms for electronic marketing. Germany and Austria are consent-heavy in practice. France and the UK are more permissive for genuinely profession-related outreach. Treating the EU as one jurisdiction is a common and expensive mistake.
The United States: CAN-SPAM, CCPA, and the Delete Act
US rules are structurally different. The CAN-SPAM Act is opt-out rather than opt-in: you may send commercial email without prior consent provided the message is not deceptive, includes a valid physical postal address, and honors opt-outs promptly.
California adds a layer through the CCPA as amended by the CPRA, which gives residents rights to know, delete, and opt out of the sale or sharing of their personal information.
The development most relevant to this article is newer, and it directly affects the reliability of reverse-lookup data. Under California’s Delete Act, the California Privacy Protection Agency built the Delete Request and Opt-Out Platform, known as DROP, which lets a resident submit a single request that reaches every registered data broker. Consumers gained access on January 1, 2026, and as of August 1, 2026, registered brokers are required to check DROP at regular intervals and process those deletion requests.
Read that in the context of this topic. The people-search and reverse-lookup category sits squarely inside the data broker definition, hundreds of thousands of deletion requests were queued before the deadline, and brokers must now keep processing new ones on a recurring cycle.
Whatever the accuracy of those databases was last year, it is being actively reduced by law this year. Building a prospecting motion on top of them is building on a shrinking foundation.
The question a phone number does not answer
Even where the law permits outreach, having someone’s number tells you nothing about the context in which they gave it out.
A number shared with a delivery service, a doctor’s office, or a former employer was not shared with you. Deriving an email from it and then sending a pitch is the kind of thing that produces complaints, and complaints damage your sending domain long before they attract a regulator.
That is the practical argument, and for most teams it lands harder than the legal one. Spam complaints above the thresholds enforced by major mailbox providers get your domain throttled or blocked, which affects every email your company sends, including to existing customers.
The approach that actually works: identity first, number second
Here is the workflow that produces usable, defensible data.
Turn the number into an identity, not an address. Search the number in quotes. Check whether it appears on a company website, in a directory, in a conference listing, or in a press release. If the number is professional and published, this resolves in minutes.
If it does not resolve, that is meaningful information: the number is likely personal, and personal is the wrong target for B2B outreach anyway.
- Move to the professional footprint. Once you have a name and an employer, you are on solid ground. LinkedIn, the company’s team page, published bylines, conference speaker pages, and industry directories all establish a professional identity you can legitimately reach out to about professional matters. This is also where legitimate interest becomes arguable, because you can articulate why this specific person at this specific company is relevant to what you sell.
- Find the work address rather than the personal one. Most organizations use a consistent email pattern. Once you know the pattern and the person’s name, the address follows. Reputable B2B data providers do this at scale and verify the result, which is what separates them from a guess. Waterfall enrichment, meaning querying several providers in sequence until one returns a verified match, is the standard approach when a single source comes up empty.
- Verify before you send, every time. An unverified address is a bounce, and bounces damage your sender reputation. Run addresses through verification, and treat a catch-all domain result as unverified rather than as a pass. This step is not optional housekeeping. Bounce rate is one of the clearest signals mailbox providers use to decide whether your domain is trustworthy.
- Consider just asking. If you already have the number, calling and asking for the best email is faster than any lookup, produces a perfect address, creates a record of consent, and starts a conversation. Teams skip this because it feels less scalable, but AnyBiz’s AI phone calls exist precisely to make that first-touch conversation scale, and a number that has been qualified by a call is worth more than an email inferred from a database.
When the phone number is the better channel anyway
It is worth questioning the premise. The reason to convert a number into an email is usually that email is cheaper to scale and easier to sequence. Both are true.
But if you already hold a phone number, you hold the channel with the highest immediate response rate available to a sales team, and converting it to a colder channel is not obviously an upgrade.
A more effective pattern for most B2B teams is multichannel rather than conversion: use the number for a call or a voicemail, use LinkedIn for a connection, and use email for the follow-up that references the earlier touch.
AnyBiz’s own analysis of what drives reply rates across 16,880 emails points the same direction, since the messages that perform are the ones with a real reason for contact rather than the ones that simply arrived. A prior call is a real reason for contact. A database match is not.
Combining channels also solves the compliance problem more elegantly than any lookup does, because a conversation generates its own permission.
How to tell a real data provider from a liability
If you are going to buy data, the diligence is short and worth doing.
Ask where the records come from. A provider that cannot describe its sourcing in specific terms is a provider whose data may trace back to scraped or leaked datasets, including the ones described earlier in this article.
Ask whether they will sign a data processing agreement. A vendor unwilling to sign a DPA is telling you they do not expect to be able to meet GDPR obligations, and under that regulation the liability does not stay with them.
Ask how they handle deletion and opt-out requests, and specifically whether they are registered as a data broker where required and processing requests through mechanisms like DROP. A provider that cannot answer is a provider whose records you may be processing unlawfully.
Ask how often the data is refreshed and whether addresses are verified at delivery rather than at collection. Contact data decays fast, and a verified-at-collection address from two years ago is a bounce waiting to happen.
Finally, be suspicious of anything free, unlimited, and instant. The economics of maintaining accurate, lawfully sourced contact data do not support that offer, so something else is paying for it.
Mistakes that create real risk
Treating a personal email address as equivalent to a work address is the most common one. Under the ePrivacy regime a personal address generally requires consent, and even where it does not, sending a B2B pitch to someone’s private inbox is the fastest route to a spam complaint.
Buying a list because it was cheap is the second. You inherit the sourcing problem and the liability, and you usually inherit a high bounce rate that damages your domain in the first send.
Skipping verification to hit a volume target is the third, and it is self-defeating: the deliverability damage costs more than the extra meetings the volume was supposed to produce.
Also worth avoiding: sending without a working opt-out, failing to record where each contact came from, keeping prospect records indefinitely with no retention policy, and assuming that because a tool is commercially available its output is lawful for you to use.
Where this leaves you
The premise behind most articles on this topic is that a phone number is a key that unlocks an email address if you find the right tool. It is not, and it has not been for years.
The databases were never built in that direction, the platform features that approximated it were shut down and fined, and the regulatory trend through 2026 is actively shrinking what the remaining sources hold.
The workflow that does work is less exciting and considerably more reliable. Use the number to establish who the person is and where they work.
Confirm that they are a legitimate professional target for what you sell. Find and verify their work email through their professional footprint. Document where the data came from, disclose it, and make opting out effortless. Or skip the conversion entirely and use the channel you already have.
If you want that sequence running without assembling it yourself, AnyBiz combines AI email outreach, AI phone calls, and LinkedIn engagement into a single motion, so identification, enrichment, and multichannel follow-up happen in one place rather than across four tools and a spreadsheet.
You can see how the pieces fit on the product overview or book a demo.
📜 Related reading
- AI lead generation: best practices and strategy guide
- Generating leads with email marketing strategies
- Email tone drives reply rates: what 16,880 emails show
- AI BDR adoption in 2026: what the data actually shows
FAQ
Is it legal to find someone’s email from their phone number?
Finding a business contact through their professional footprint and contacting them about a relevant professional matter is generally lawful in the US under CAN-SPAM and in much of the EU and UK under legitimate interest, provided you document your basis, disclose your source, and offer an opt-out. Deriving a private individual’s personal email in order to market to them is a different activity with a much weaker legal footing, and in several jurisdictions it requires consent you do not have.
Do reverse phone lookup tools actually return email addresses?
Sometimes, but the result is usually an old personal address rather than a current work address, and the tool typically cannot tell you where the record came from. For B2B purposes the hit rate and the accuracy are both poor compared with identity-based enrichment.
Can I still find someone on Facebook using their phone number?
No. Meta disabled that capability in April 2018, and the contact importer tools that made large-scale phone-number matching possible were the subject of a €265 million GDPR fine from Ireland’s Data Protection Commission in 2022. Guides that still recommend this were not tested before publication.
What is the fastest legitimate way to get an email when I have a number?
Call and ask. It takes a minute, produces an address that will not bounce, and gives you a documented reason for the subsequent email. If calling is not an option, identify the person and company from the number, then use a B2B data provider to find and verify the work address.
Does a work email count as personal data under GDPR?
Yes. An address that identifies a named individual is personal data even in a professional context. A generic role address such as info@company.com is a different case, since it does not identify a person.
What happens if I get this wrong?
The regulatory risk is real but the operational risk usually arrives first. High bounce rates and spam complaints degrade your sending domain’s reputation, which reduces deliverability for every email your company sends, including to customers who want to hear from you. That damage takes weeks to repair and is entirely avoidable.
Should I use free email lookup tools?
Treat any result from one as an unverified lead rather than a confirmed address, verify it independently before sending, and do not build a workflow on a source that cannot document its provenance.
