SMS OTP depends on the number, not on verified SIM ownership or stable identity binding. If the number is reassigned, the code goes to whoever controls that number now, which turns a recovery factor into an access path for the wrong person.
Why number reassignment breaks SMS OTP security
sms otp is only as strong as the binding between the phone number and the intended user. When a number is recycled, ported, or otherwise taken over by a new holder, the next OTP goes to that current holder. The control still works technically, but it no longer proves the original account owner is present, which makes the factor unsafe for recovery or step-up access.
What changes when the phone number no longer belongs to the original user?
The security property that fails is identity continuity. An SMS code is delivered to a reachable number, not to a verified person, device, or SIM lifecycle state. If the number moves to a different subscriber, the authentication event is redirected without the relying party knowing the binding has changed.
That means the weakness is not SMS delivery itself, it is the assumption that the phone number remains a stable proxy for the same account holder. In practice, number ownership can change through reassignment, reuse after inactivity, SIM swap, port-out, or carrier administration. Once that happens, the OTP becomes a reachable credential rather than a reliable second factor.
For practitioners, the key distinction is between possession of a routed destination and possession of a stable authenticator. If your workflow treats SMS OTP as proof of ongoing subscriber control, you are relying on an external lifecycle event you do not govern. That is why SMS OTP is especially fragile for account recovery, password reset, and high-risk step-up challenges.
Why attackers care about reassigned numbers
A recycled number can create a clean path into accounts that still trust it. An attacker or accidental new subscriber does not need to defeat the OTP mechanism, only to receive the code that the service still sends. That makes stale number bindings attractive wherever the account recovery flow trusts SMS more than current account posture.
The risk is amplified when SMS is used after a password reset, on support-assisted recovery, or as a fallback after other authenticators fail. In those cases, the number becomes an access bridge to the account, not just a notification channel. The MFA Guide covers why OTP and other legacy MFA methods become easier to bypass when the factor is not strongly bound to the right user.
Risk and Threat Considerations
Number reassignment creates a trust failure because the service continues to accept a factor whose ownership has drifted outside the original identity. That can expose password reset flows, recovery channels, and high-value accounts to takeover even when the user never intentionally shared credentials.
Failure mechanism: The account still trusts the phone number as an authenticator after the telecommunications provider has reassigned that number to someone else, so the OTP is delivered to the wrong party.
Impact: The attacker or new number holder can receive recovery codes, intercept step-up authentication, and convert a fallback factor into account access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5, OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Covers authenticator assurance and phishing-resistant authentication choices |
| Recommendation — Prefer phishing-resistant authenticators over SMS for recovery and step-up access. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Applies because OTP safety depends on authenticators and their lifecycle control |
| Recommendation — Rotate or retire authenticators when their binding to a user is no longer trustworthy. | ||
| OWASP ASVS | V6 — Authentication | SMS OTP is an authentication factor whose trust weakens when ownership changes |
| Recommendation — Require stronger authentication than SMS where account recovery or privilege is at stake. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Addresses access control decisions based on stable identity assurance |
| Recommendation — Use identity-bound authentication controls that remain valid after number reassignment. | ||
Practitioner Guidance
What to verify: Check whether SMS OTP is allowed anywhere the action has recovery or privilege implications. If the number can unlock password reset, MFA reset, or admin re-entry, treat it as a high-risk recovery path rather than a routine second factor.
Decision rule: If the phone number is not continuously re-verified against the current subscriber or SIM lifecycle, do not rely on SMS OTP as the only proof of control for sensitive access. Prefer phishing-resistant methods for primary authentication and reserve SMS, if kept at all, for low-consequence notifications.
What practitioners underestimate: The main hazard is not that SMS sometimes fails, but that it can succeed for the wrong person after ownership changes. That means the control can look healthy in testing while still being unsafe in production.
Practitioner takeaway: Treat the phone number as a mutable delivery route, not as durable identity evidence; once ownership can change, SMS OTP should never be the sole recovery trust anchor.