TL;DR: Recycled mobile numbers can redirect SMS-based login and recovery flows to new subscribers, creating account takeover and fraud exposure across social, banking, healthcare, and e-commerce accounts, according to IDlayr. The trust assumption is the problem: number ownership is not the same as SIM-linked identity, so mobile login controls need stronger binding than SMS OTP alone.
At a glance
What this is: This is a field analysis of how recycled mobile numbers undermine login trust when SMS-based identity verification relies on the phone number rather than the active SIM.
Why it matters: It matters because IAM teams that still treat mobile numbers as stable identity bindings can expose recovery flows, authentication paths, and downstream account control to reassigned-number abuse.
By the numbers:
- In the United Kingdom, mobile providers often recycle numbers within 70-180 days.
- A study of 259 recycled numbers found that 215 were still vulnerable to exploitation.
Context
Mobile number recycling creates an identity problem, not just a telecom one. When a number is reassigned, the new subscriber may inherit login, reset, or recovery paths that were never designed to survive a change in ownership.
The issue becomes material wherever SMS OTP, password reset, or phone-number recovery is treated as proof of account control. For IAM teams, the key question is whether the factor being checked is the number itself or the currently active SIM tied to that number.
The article’s central point is simple: a stable-looking identifier is not a stable identity binding. That makes recycled numbers a governance issue for human IAM and customer identity, especially where mobile number verification is still accepted as a primary trust signal.
Key questions
Q: What breaks when a mobile number is recycled in account recovery flows?
A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership. Password resets, SMS OTP and linked-service notifications can reach the wrong person, enabling account takeover and fraud. The control failure is the assumption that possession of the number still equals entitlement to the account.
Q: Why does SMS OTP become unsafe when number ownership changes?
A: SMS OTP depends on the number, not on verified SIM ownership or stable identity binding. If the number is reassigned, the code goes to whoever controls that number now, which turns a recovery factor into an access path for the wrong person.
Q: How can security teams reduce risk from recycled mobile numbers?
A: Teams should verify the live relationship between the number and the active SIM before allowing login or recovery, and they should reserve SMS for low-assurance use cases. High-impact accounts need stronger binding than a phone number alone.
Q: When should organisations stop trusting mobile numbers as an authentication factor?
A: They should stop relying on mobile numbers whenever the account can unlock sensitive data, financial services, or recovery of other credentials. A phone number is a mutable contact attribute, not a durable proof of identity.
Technical breakdown
Why recycled numbers break SMS login trust
SMS-based login and recovery assumes the person receiving the code still controls the original account-linked number. Recycled numbering breaks that assumption because the number can be reassigned to a new subscriber while the application still treats it as an authentic recovery factor. The failure is not in message delivery. It is in identity binding, where the factor validates possession of a number but not continued control of the original identity relationship. That distinction matters whenever the number is used as a proxy for account ownership.
Practical implication: treat SMS delivery as a transport mechanism, not as proof that the original account holder remains in control.
MSISDN, SIM, ICCID, and IMSI: what must be bound
The article distinguishes the mobile number from the SIM layer beneath it. The MSISDN is the phone number, the ICCID identifies the SIM, and the IMSI identifies the subscriber relationship associated with that SIM. Secure mobile identity requires checking that these elements still align at the time of authentication or recovery. If the number has been recycled or the SIM changed, the system should detect the mismatch and force re-verification before access is granted. That is a stronger model than phone-number-only checks because it ties trust to the active subscriber state.
Practical implication: verify the number and the SIM relationship together, not the number in isolation.
Why phone-number recovery becomes a fraud chain
Once a recycled number receives password resets or 2FA messages, the new holder can step into the previous account owner’s trust path. That creates a chain from account takeover to linked services such as banking, messaging, wallets, and healthcare portals. The article also notes that SMS is vulnerable to SIM swap and network-level interception, which further weakens its value as a sole authentication factor. In practice, the weakness is cumulative: recovery, login, and downstream account linkage all inherit the same fragile assumption about number ownership.
Practical implication: remove SMS-only recovery from any account path that can unlock financial, health, or high-impact services.
Threat narrative
Attacker objective: The objective is to hijack accounts and exploit linked services by inheriting trust through a reassigned mobile number.
- Entry occurs when a recycled mobile number is reassigned to a new subscriber who then receives SMS traffic intended for the previous owner.
- Credential access follows when password resets or SMS OTP codes are delivered to that number and used to unlock the account.
- Escalation occurs when the newly accessible account is used to pivot into linked services such as banking, messaging, or e-commerce.
- Impact is account takeover, fraud, exposure of personal data, and reputational harm to the affected brand.
NHI Mgmt Group analysis
Phone-number trust is an identity binding failure, not a messaging failure: The article shows that SMS OTP can still deliver a code correctly while failing the security objective entirely. The control problem is that the number is being treated as evidence of account ownership even after reassignment. For identity programmes, that means the binding layer is the real control surface, not the text message itself.
Recycled-number risk exposes a broken lifecycle assumption: Mobile identity schemes often assume a number remains attached to one person long enough for authentication and recovery to work safely. That assumption fails when telecom operators recycle numbers within weeks or months. The implication is that login governance must account for identity continuity over time, not just successful factor delivery at a point in time.
Live SIM binding is the relevant trust anchor: The article’s strongest concept is the need for a live relationship between number, SIM, and verified identity. That is not a cosmetic upgrade to SMS OTP. It is a shift from static possession checks to runtime validation of subscriber state, which is the only way to detect reassigned-number drift before access is granted.
Mobile identity is becoming a governance problem for human IAM and customer identity: This is not just a fraud control issue. Any programme that uses phone numbers in onboarding, recovery, or step-up authentication must treat number ownership as mutable and revocable. The practical conclusion is that the identity model must survive subscriber churn, or it will fail at the exact moment recovery is needed.
Deterministic mobile verification is replacing probabilistic trust: The article points toward real-time verification with the carrier as the next control pattern. That matters because mobile identity can no longer rely on historical confidence in a number. Practitioners should read this as a signal that authentication assurance is moving closer to the network and SIM lifecycle, where the actual ownership signal lives.
What this signals
Recycled-number drift turns identity recovery into an exposure window: Teams that still use phone-number-based recovery need to assume that ownership can change outside their lifecycle controls. The programme question is no longer whether a code arrived, but whether the recipient still matches the identity that was originally trusted.
Mobile identity needs a live binding model: Number, SIM, and verified subscriber state have to move together or the trust model fails. That pushes practitioners toward stronger mobile assurance patterns that can detect reassignment before authentication is granted.
For practitioners
- Audit every SMS-based recovery path Map where phone numbers are used for password reset, step-up authentication, and account recovery, then identify which of those flows can unlock financial, health, messaging, or e-commerce access.
- Bind mobile identity to the active SIM Require checks that the number and current SIM state still align before issuing access or recovery tokens, especially where the account can be reused after a number change.
- Remove SMS-only trust from high-impact accounts Move the highest-risk journeys away from number-only verification and reserve SMS for low-assurance notifications rather than account recovery or login proof.
- Introduce mismatch-driven re-verification Trigger a fresh identity proofing step whenever the number has been recycled, ported, or re-associated with a different SIM than the one previously trusted.
Key takeaways
- Recycled mobile numbers expose a trust gap in SMS-based identity flows because the number can outlive the account holder.
- The risk is concrete, not theoretical, with number recycling happening at scale and recycled numbers remaining exploitable.
- IAM teams should treat mobile numbers as mutable contact data and require SIM-bound verification for high-impact access paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SMS OTP and mobile-number login are the insecure authentication pattern at issue here. |
| NHI-10 — Human Use of NHI | A human identity programme is using a mutable mobile number as a trust factor. | |
| Recommendation — Replace number-only authentication with stronger binding to the active SIM and verified subscriber state. Review where human login flows rely on phone numbers and move high-risk journeys to stronger factors. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article is about authenticators and recovery channels used in digital authentication. |
| Recommendation — Reassess SMS-based authenticators against assurance requirements before using them for recovery or step-up. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Recycled-number exposure affects who can obtain or reuse access through recovery paths. |
| Recommendation — Enforce access and recovery controls that verify the current identity relationship before granting entitlements. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The attack pattern hinges on acquiring codes and then pivoting into linked accounts. |
| Recommendation — Map recycled-number abuse to credential access and lateral movement when building detection and response coverage. | ||
Key terms
- Recycled Mobile Number: A recycled mobile number is a phone number that has been disconnected from one subscriber and reassigned to another. In identity systems, reuse becomes a security problem when the old number still functions as a recovery or authentication signal for accounts tied to the previous owner.
- SIM Binding: SIM binding is the practice of linking a mobile number to the active SIM or subscriber context that currently controls it. It strengthens assurance by checking more than message delivery, which helps detect number reassignment and prevents stale recovery paths from surviving ownership changes.
- Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
- Identity Binding: The process of linking an external credential or login method to an internal account record. Strong binding prevents duplicate accounts, broken recovery paths, and unsafe merges when users authenticate through different identity sources or wallet-based credentials.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org