Comment by esamatti

Hash the phone number in the browser before sending it to your server. That way it is at least possible to verify via devtools what is being send.

Heck. Allow even prehashed phone number to be entered.