Google has awarded $5,000 to a researcher who found security holes that enabled brute-forcing the phone number of any user.