We search for lepton flavor and lepton number violating τ decays into a lepton (ℓ = electron or muon) and two charged mesons (h, h′ = π± or K±), τ- → ℓ- h+ h′ - and τ- → ℓ+ h- h′ -, using 671 fb-1 of data collected with the Belle detector at the KEKB asymmetric-energy e+ e- collider. We obtain 90% C.L. upper limits on the branching fractions in the range (4.4 - 8.8) × 10- 8 for τ → e h h′, and (3.3 - 16) × 10- 8 for τ → μ h h′ processes. These results improve upon previously published upper limits by factors between 1.6 to 8.8. © 2009 Elsevier B.V. All rights reserved.