TL;DR: Mobile-number recycling can hand a new subscriber access to accounts tied to the previous owner when authentication depends on the number alone, according to IDlayr. SMS OTP and recovery flows that ignore SIM-level verification create account takeover risk, fraud exposure, and reputational damage.
At a glance
What this is: This is an analysis of how recycled mobile numbers weaken identity verification when systems treat the phone number as proof of account ownership.
Why it matters: It matters because IAM and fraud teams need to understand that phone-number based recovery can transfer access to the wrong person when number ownership changes.
Context
Mobile number recycling is a governance problem, not just a telecom quirk. When an account relies on the phone number as the identity anchor, the control assumes the number remains bound to the same person over time.
The article shows why that assumption fails in practice. Mobile network operators routinely reissue inactive numbers, so SMS-based recovery and OTP flows can outlive the original subscriber and create a trust break between identity, device, and account ownership.
Key questions
Q: What breaks when a mobile number is recycled in account recovery flows?
A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership. Password resets, SMS OTP and linked-service notifications can reach the wrong person, enabling account takeover and fraud. The control failure is the assumption that possession of the number still equals entitlement to the account.
Q: Why does SMS OTP create higher takeover risk when phone numbers are reused?
A: Because SMS OTP proves reachability of the number, not stable ownership of the SIM or account. When a provider recycles a number, the code can go to a different person, and that person may inherit access to linked services. The risk grows where recovery flows depend on the same number across many accounts.
Q: How should organisations reduce dependence on SMS for identity verification?
A: Move privileged users to phishing-resistant methods, use number-change detection as a gating control, and require a separate authoritative proofing step for any high-risk reset or recovery. SMS can remain a contact route, but it should not be treated as proof of identity. The goal is to make account recovery independent of a single mutable channel.
Q: When should teams stop trusting SMS OTP for sensitive accounts?
A: They should stop relying on SMS OTP whenever the account holds financial, healthcare, or other sensitive data, or whenever number reuse is common in the target market. In those settings, SMS is too weak to stand alone as a recovery or step-up factor.
Technical breakdown
Why phone-number identity breaks after recycling
A mobile number is an addressable identifier, not a stable proof of personhood. When a provider reassigns that number, any system that still treats it as the primary recovery factor will deliver authentication codes or reset links to the wrong recipient. The failure is structural: the account layer assumes continuity of ownership, while the network layer can legally and routinely break that continuity. In identity terms, the binding between user, number, and session credential is too weak to survive reissuance.
Practical implication: stop using the phone number alone as the trust anchor for account recovery or step-up authentication.
Why SMS OTP is fragile in recycled-number scenarios
SMS OTP depends on possession of the reachable number, not on verified control of the underlying SIM or subscriber relationship. That distinction matters because recycled numbers, SIM swaps, and telco-level interception can all separate the message recipient from the original account holder. The problem is not only delivery failure, but misplaced trust in the delivery path. Once the number changes hands, OTP becomes a routing mechanism that can authenticate the wrong identity.
Practical implication: treat SMS OTP as a weak factor for recovery and high-risk sign-in flows, especially where number reuse is common.
How SIM binding changes the trust model
SIM binding shifts verification from a mutable phone number to the underlying subscription identity. The article points to SIM-level identifiers such as ICCID and IMSI as a stronger way to detect whether the number is still attached to the expected mobile identity. That does not make the phone channel infallible, but it lets systems detect mismatches when a number is reassigned or moved to a new SIM. The technical change is simple: verify the number in context, not in isolation.
Practical implication: add SIM-level checks or equivalent mobile identity validation before allowing sensitive recovery or access flows.
Breaches seen in the wild
- iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Mobile number recycling exposes an identity binding failure, not just an authentication weakness. The article shows that when a phone number is reused, the system’s implicit promise of continuity no longer holds. That breaks the assumption that a recovery factor still belongs to the original subscriber, and it turns phone-number identity into a time-sensitive trust relationship rather than a durable control. Practitioners should treat number reissue as a governance boundary, not a routine telecom event.
SMS OTP is a routing control, not an ownership control. The message reaches the device that currently holds the number, which is not the same thing as the rightful account owner. That distinction is why recycled-number abuse can bypass otherwise sound account workflows. Teams that depend on OTP for recovery are relying on a delivery channel whose security collapses when the number changes hands.
Phone-number-based recovery creates an identity blast radius across consumer accounts. The article’s examples, including social media, banking, healthcare, and ecommerce, show how one reused number can fan out across multiple services. The practical lesson is that account recovery design cannot assume a single factor maps cleanly to a single person over time. Identity assurance must survive reassignment, not just initial enrollment.
The named concept here is mobile identity trust drift: the gap that opens when an account still trusts a number after the network has detached it from the original owner. This is not a theoretical edge case, because mobile numbers are routinely recycled at scale. The implication is that identity programmes need stronger lifecycle checks on mobile credentials, or they will keep certifying stale trust.
What this signals
Mobile identity trust drift: mobile-number reuse should be treated as a lifecycle problem, not just a channel weakness. Once the number is reassigned, the old account relationship is no longer reliable, so recovery and step-up logic must be built around change detection rather than static enrollment assumptions.
Identity teams should review any flow where the phone number is still treated as a durable account anchor, especially password reset and fraud-sensitive recovery journeys. The failure mode is simple: the control validates the route to the user, not the user itself.
For practitioners
- Replace number-only recovery with stronger verification Require an additional possession or subscriber check before password reset, account recovery, or high-risk profile changes. Do not let a recycled number by itself authorize access to a live account.
- Validate SIM-level binding before step-up authentication Check whether the current SIM or subscriber relationship matches the enrolled mobile identity before sending sensitive OTP or recovery flows. Block access when the number and SIM no longer align.
- Remove SMS OTP from high-risk workflows Use safer factors for banking, healthcare, and other accounts where number recycling could expose regulated or financially sensitive data. Reserve SMS only for low-risk notifications or as a fallback path.
- Detect number reassignment as a lifecycle event Treat recycled numbers as an identity lifecycle change that should trigger re-verification, not as a normal account state. Reconfirm ownership whenever mobile identity attributes materially change.
Key takeaways
- Recycled mobile numbers can transfer access to the wrong person when identity systems rely on the phone number as the primary recovery anchor.
- SMS OTP is vulnerable in this scenario because it confirms delivery to the number, not ownership of the SIM or the account.
- Practitioners should treat number reassignment as a trust change that triggers re-verification, stronger factors, or both.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SMS OTP and phone-number recovery are the core insecure authentication pattern in this article. |
| NHI-10 — Human Use of NHI | The phone number is being used as a credential, even though it is not a durable identity factor. | |
| Recommendation — Replace number-only authentication with stronger verification that binds access to the actual mobile identity. Stop using mutable mobile numbers as primary account credentials for sensitive workflows. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article focuses on how authenticators and recovery factors become unsafe when they outlive their trust relationship. |
| IA-8 — Identification and Authentication (Non-Organizational Users) | Consumer and customer identity proofing is central because the affected accounts are external user accounts. | |
| Recommendation — Manage authenticator lifecycle so phone-based recovery is revoked when ownership changes. Apply stronger identity proofing before allowing mobile numbers to act as recovery factors. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about access being granted through an outdated entitlement assumption tied to a reused number. |
| Recommendation — Review authorizations that still depend on mutable phone-number possession and remove that dependency. | ||
Key terms
- Mobile Number Recycling: The reassignment of an inactive phone number from one subscriber to another by a mobile operator. In identity systems, this becomes a security issue when applications keep trusting the number after ownership changes, because the old recovery path can reach a new person.
- SIM Binding: SIM binding is the practice of linking a mobile number to the active SIM or subscriber context that currently controls it. It strengthens assurance by checking more than message delivery, which helps detect number reassignment and prevents stale recovery paths from surviving ownership changes.
- Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org