Android Question Help! phone number hacked.

My first thought is for your friend to buy a new SIM for their phone service provider network, and then log in to the phone service account and swap his phone number to the new SIM.

But... if the hacker has access to your friend's contacts, that makes it sound like the hacker is already in your friend's phone service account and has likely changed the password, in which case I'd still buy a new SIM, and then call the phone company to do the activation "manually".

Install a virus scanner on his phone (and your connected devices like his PC) and execute a deep scan all your devices with a (free) antivirus program like AVG-free https://www.avg.com/en-ww/store#mobile. Change all your passwords from all your accounts

Let your phone service deactivate the number, and get a new one. It may be a SIM swap

Change their number would be the best option.

It sounds like the 'bad actor' is simply spoofing their number. How they got the contact list could be as simple as installing a 'dodgy' app that requests access to contacts, which it then uploads.

Also, when they change their number, make sure it's not listed in contacts (some phones add it as My Phone etc), as this makes it easier for 'bad actors' that grab contacts.

My phone has no idea what my numbers are, my sims don't tell android anything. Even in Android settings they are listed as unknown.