Should be pretty easy to fix. Just HMAC (or just concatenate pepper and hash, honestly) the phone number and use that as the identifier.