Well, it’s sending a sha256 for your phone number, how is this not good enough? How you would expect to check the number in the database without hashing or passing it clear?
For example, HIBP does not send your password (or its complete hash) to the backend in order to find if it has been previously exposed. They use this method: https://blog.cloudflare.com/validating-leaked-passwords-with...