You're assuming that the hashing algo used in the app is indecipherable by an attacker - if the hashing algo used is known, then the attacker does the same as done in this SnapChat attack, except just hashing the number first.
One typically uses salting to randomly generate a hash function. (so even if you know it was, say, SHA512, you have to guess the salt to reverse engineer)
No matter what you do, you're running that code on the client application, so it would then fall back on relying on code obfuscation unless I'm missing something.
Comments
You're assuming that the hashing algo used in the app is indecipherable by an attacker - if the hashing algo used is known, then the attacker does the same as done in this SnapChat attack, except just hashing the number first.
One typically uses salting to randomly generate a hash function. (so even if you know it was, say, SHA512, you have to guess the salt to reverse engineer)
No matter what you do, you're running that code on the client application, so it would then fall back on relying on code obfuscation unless I'm missing something.