We search for lepton flavor and lepton number violating tau decays into a lepton (ell = electron or muon) and two charged mesons (h,h' = pi^\pm or K^\pm), tau- -> ell-h+h'- and tau- -> ell+h-h'-, using 671 fb^{-1} of data collected with the Belle detector at the KEKB asymmetric-energy e+e- collider. We obtain 90% C.L. upper limits on the branching fractions in the range (4.4-8.8)x10^{-8} for tau -> ehh', and (3.3-16)x10^{-8} for tau -> muhh' processes. These results improve upon pre