Your phone number should not be your master key
Your real mobile number is one of the weakest links in your digital life, and too many Australians treat it as if it were a secure identity credential. It is not. If you want one practical lesson from "EX MATRIXE LIBER SUM: THE SOVEREIGN EXIT", start here: reduce the power of your phone number before someone else uses it against you.
This is not paranoia. It is housekeeping. A phone number is widely shared, often recycled, commonly used for logins and password resets, and routinely relied on by businesses that should know better. That makes it dangerous.
Shane St Reynolds argues in "EX MATRIXE LIBER SUM: THE SOVEREIGN EXIT" that digital freedom is not just about what platform you use. It is about refusing bad defaults. Tying your email, bank alerts, social media, cloud accounts and identity checks to one public-facing number is a bad default.
If you want the book, get it from Shane St Reynolds’ Amazon author store here: Shane St Reynolds on Amazon. "EX MATRIXE LIBER SUM: THE SOVEREIGN EXIT" is available in paperback and Kindle, along with titles including "Reprogram Your Life" and "Get a Second Opinion Before You Sign".
The common mistake most people make
Most people think the main threat is a hacker “getting into the phone”. Often the easier path is getting control around the phone: number porting, SMS interception, weak identity checks, or password resets sent to a number you use everywhere.
The counter-intuitive point is this: convenience creates concentration risk. The more accounts that rely on one number, the more valuable that number becomes.
In Australia, telcos are regulated by the Australian Communications and Media Authority, and privacy issues may involve the Office of the Australian Information Commissioner under the Privacy Act 1988. None of that changes the practical issue. By the time you are arguing with a provider, disputing an unauthorised change, or making a complaint to the Telecommunications Industry Ombudsman, the damage may already be done.
Prevention beats complaint handling.
The 60-minute reset I recommend
You do not need a bunker. You need a short, disciplined cleanup. Here is the process.
- List every account that uses your mobile number.
Start with your primary email, banking, super, myGov-linked services, cloud storage, messaging apps, social media, domain registrar, crypto exchange, and password manager. If you use a password manager, search your vault for your phone number and note every entry that contains it. - Identify your highest-risk account: your email.
If someone gets your main email, they often get the reset links for everything else. Check whether password recovery is tied to SMS. If it is, change it if a stronger option is available. - Replace SMS two-factor authentication where you can.
Use an authenticator app or a hardware security key if the service supports it. SMS is better than no second factor, but it is not the best option for important accounts. - Remove your number from public-facing profiles.
Check business websites, domain WHOIS records, social media bios, Google Business profiles, marketplace listings and old PDFs. Search your exact number in Google in quotation marks. - Add a telco account PIN or extra verification if available.
Ask your provider what extra account protection they offer for number changes, SIM replacement or port-out requests. Make them tell you the process. - Separate functions.
If practical, use one number for public contact and another for sensitive account recovery. The point is not secrecy for its own sake. The point is reducing cascade failure. - Check your bank and super alerts.
Review how alerts and verification are delivered. Some providers let you use app-based approval or stronger controls. Use them. - Lock down your domain registrar and business systems.
For business owners, your domain name, Microsoft 365 or Google Workspace tenant, invoicing platform and payment systems matter more than your social media. A stolen domain or email tenant can become a fraud event fast.
What to say when a provider pushes you back to SMS
Do not ask vague questions. Use direct wording.
“I want to remove SMS as a recovery or verification method on this account if another secure option is available. What alternatives do you support today?”
For your telco:
“Please place the strongest available protection on my account for SIM replacement, number porting and profile changes. What PIN, password or identity controls can you add, and what events will trigger them?”
If a provider says they only support SMS, write that down. It tells you which accounts deserve more attention and which providers are behind the standard.
Three Australian checks worth doing this week
1. Review your credit file for unfamiliar activity
Identity misuse often shows up in credit applications. In Australia, you can request a free credit report from major credit reporting bodies. If you see unfamiliar enquiries or accounts, act quickly.
2. Know where to complain if your data is mishandled
If an organisation covered by the Privacy Act 1988 mishandles your personal information, the OAIC is the national privacy regulator. If the issue involves a telco service or complaint handling failure, the Telecommunications Industry Ombudsman may be relevant. If online abuse or image-based abuse is involved, the eSafety Commissioner may also matter. Different problems go to different places. Sending everything to the wrong body wastes time.
3. Check whether your business has exposed staff numbers online
Many businesses publish direct mobile numbers on websites, tender documents, PDFs and old media releases. Search the site, search Google, and search attachment-heavy pages. If your staff numbers are public and those same numbers are used for account recovery, you have handed attackers a map.
Why business owners and public figures should care more than everyone else
If you run a business, manage family assets, hold public office, speak publicly, or deal with disputes, your number is not just a contact point. It can be a route into negotiations, settlements, invoices, reputational attacks and impersonation.
I have long said the same thing in finance and reputation matters: concentration risk is deadly. In lending, one bad covenant can choke an otherwise viable deal. In digital life, one overused phone number can do the same.
If online impersonation, false content or platform abuse is already part of your problem, start with proper takedown pathways and evidence preservation, not angry messages. That is exactly why services such as Takedown exist. If the issue overlaps with legal commentary or public-interest reporting, material at shanereynolds.com.au and Street Angel may also help you think straight about the next move.
The bigger lesson from "EX MATRIXE LIBER SUM: THE SOVEREIGN EXIT"
The point of "EX MATRIXE LIBER SUM: THE SOVEREIGN EXIT" is not that you must vanish from modern life. The point is that you should stop accepting digital arrangements that make you easy to profile, easy to pressure and easy to lock out.
That starts with simple structural changes. Not dramatic ones. Remove your number where you can. Stop using SMS as the default where stronger methods exist. Ask providers better questions. Separate public contact from private recovery. Audit before there is a crisis.
That is how sovereignty looks in practice: fewer weak dependencies, less blind trust, more deliberate control.
General information only.
Get the book and get practical help
If you want the full argument and more practical digital-freedom thinking, start with Shane St Reynolds’ Amazon author store and pick up "EX MATRIXE LIBER SUM: THE SOVEREIGN EXIT" in paperback or Kindle.
If you want tailored help with digital risk, reputation issues, commercial matters or a second set of eyes on a serious problem, book a consultation at https://shanestreynolds.com/contact, email [email protected] or call 08 6263 6236.