Concerns over Facebook’s phone number look-up setting erupted once again Friday. A tweet from Jamie Burge highlighted that users can be looked up via their phone number. Furthermore, users cannot turn off that setting.  The tweet even prompted the social network’s former security chief, Alex Stamos to criticize the practice, Techcrunch reported. Mr. Stamos tweeted that “Facebook can’t credibly require two-factor for high-risk accounts without segmenting that from search and ads.”

Last year, Facebook was forced to admit that after months of pestering its users to switch on two-factor by signing up their phone number, it was also using those phone numbers to target users with ads. But some users are finding out just now that Facebook’s default setting allows everyone — with or without an account — to look up a user profile based off the same phone number previously added to their account.