Phone-based fraud is breaking the trust model for account recovery

At a glance

What this is: This is an analysis of why phone-based trust signals are failing, with recycled numbers, eSIM abuse, and MVNO-driven churn undermining account opening and recovery decisions.

Why it matters: It matters because fraud and IAM teams still rely on phone possession and SMS reachability as proof of continuity, which can create false approvals, account takeover risk, and avoidable friction.

Context

Phone numbers were once treated as stable proof of continuity, but that assumption breaks when numbers are recycled, reassigned, and provisioned in software. The security problem is not the phone channel itself, but the governance gap between what a number can deliver and what it can actually prove about current ownership.

For identity and fraud teams, the real issue is that legacy recovery and step-up controls often equate reachability with legitimacy. That creates a trust model that is too static for modern telecom behaviour, especially where phone signals are used as a proxy for account ownership.

The article’s starting position is typical of modern fraud environments: the weak point is not a single channel failure, but the collision between old assumptions and new infrastructure dynamics.

Key questions

Q: What breaks when a mobile number is recycled in account recovery flows?

A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership. Password resets, SMS OTP and linked-service notifications can reach the wrong person, enabling account takeover and fraud. The control failure is the assumption that possession of the number still equals entitlement to the account.

Q: Why do recycled numbers and eSIM abuse increase account takeover risk?

A: Recycled numbers inherit historical trust, while eSIMs let attackers provision and discard phone identities quickly. Together, they let fraudsters move faster than reputation systems can react. The result is that SMS-based controls can approve a transaction even when the current user has no legitimate ownership of the number.

Q: How can security and fraud teams tell whether their controls are failing?

A: Look for two signals at once: rising false positives that push real customers away and rising fraud leakage that appears only after chargeback analysis. If both are increasing, the decision layer is probably too slow, too binary, or too detached from session context.

Q: Should organisations treat SMS recovery differently from login authentication?

A: Yes. Recovery is usually a higher-risk decision because it can restore access after the original assurance has already been weakened. SMS may still be useful as one signal, but recovery should require stronger continuity evidence than routine login, especially where recycled numbers and eSIM provisioning are common.

Technical breakdown

Why recycled phone numbers undermine identity continuity

A recycled number can still receive SMS and look active even after ownership has changed. That means a legacy system may infer trust from connectivity while missing the fact that the current user is not the original subscriber. The technical failure is not reachability, but continuity: the identity system cannot tell whether possession is persistent or merely temporary. Once reissue happens, historical legitimacy becomes a liability because the signal now describes infrastructure state, not user state.

Practical implication: Treat number tenure as an input signal, not as proof of account ownership.

How eSIM and MVNO dynamics accelerate phone fraud

eSIMs make phone provisioning faster, more portable, and easier to automate, while MVNO ecosystems add churn and abstraction between the customer and the underlying carrier relationship. That combination lets fraud actors rotate numbers, discard them quickly, and return with new phone identities at scale. In practice, this compresses the time window in which reputation-based systems can learn or react, so the number’s apparent legitimacy can outlast its real trust value by very little.

Practical implication: Build controls that evaluate ownership continuity and change events, not just carrier presence.

Why SMS confirms delivery but not identity

SMS is a transport channel, not an identity proof. A message arriving at a device only proves routing success at that moment, not who controls the number, whether the number was reassigned, or whether the request reflects genuine user intent. When organisations use SMS for account recovery or step-up authentication, they are making an implicit assumption that delivery equals legitimacy. That assumption is what attackers exploit through recycled numbers, borrowed trust, and automated account abuse.

Practical implication: Use SMS as a weak signal in a broader policy decision, not as the deciding factor.

NHI Mgmt Group analysis

Borrowed phone trust is now a governance problem, not a channel problem. The article shows that organisations are still treating phone numbers as durable identity anchors even though the underlying trust signal has become unstable. For IAM and fraud programmes, the issue is not whether SMS works, but whether the system can prove continuity of ownership at the moment of decision. The practitioner conclusion is that recovery governance must move from possession checks to ownership continuity.

Recycled-number fraud is a named concept worth separating from generic account takeover. It describes a failure mode where historical legitimacy, carrier reachability, and current identity diverge. That distinction matters because many controls are built to validate delivery or tenure, not reassignment risk. The practitioner conclusion is to classify phone-based decisions by current trust state, not by the apparent quality of the number.

eSIM expansion reduces the half-life of phone trust. When number assignment and discard become software-driven, any control that depends on slow ownership change is operating on outdated assumptions. This does not eliminate the value of phone intelligence, but it does force stronger policy logic around reassignment, churn, and temporary possession. The practitioner conclusion is to treat the phone channel as dynamic evidence, not a static authenticator.

Recovery flows are now the most exposed trust boundary in phone-centric identity journeys. Account opening, authentication, and reset workflows all depend on the same inherited assumption that a reachable number belongs to the right person. That creates a single failure pattern across multiple journeys, which is exactly why fraud teams should govern recovery separately from login. The practitioner conclusion is to re-baseline recovery controls as an identity assurance decision, not a communications feature.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Recycled-number fraud should be handled as identity governance, not just fraud scoring. The decision point is whether a phone number still represents the same person or merely a current route for delivery. For fraud and IAM teams, that shifts controls toward reassignment awareness, recovery governance, and step-up decisions that can react to churn in near real time.

Phone-based trust is becoming a short-lived signal. As numbers are reassigned faster and eSIM provisioning makes rotation easier, static tenure checks lose value quickly. The practical response is to move policy from fixed thresholds to live ownership continuity checks, especially in recovery and account opening.

Account recovery is the pressure test for phone identity. If a flow can be restored through a number that has already changed hands, the programme is trusting telecommunications history more than the current user. Teams should therefore separate recovery assurance from routine authentication and reserve stronger controls for the reset path.

For practitioners

• Separate ownership from reachability in phone policy Require decision logic that distinguishes a live phone number from a number that still belongs to the original customer. Use reassignment, disconnect, and churn signals to override reachability when the trust history is no longer valid.
• Tighten recovery around continuity checks Treat account recovery as a high-risk identity event and add policy checks for number tenure, recent ownership changes, and suspicious reuse patterns before allowing reset or step-up flows.
• Reduce reliance on SMS as a decisive factor Keep SMS in the flow only as one signal among others, and avoid using it as the sole proof of legitimacy for registration, authentication, or account recovery.
• Instrument phone risk policies for adaptive enforcement Use policy logic that can change treatment based on live phone intelligence, so recycled or temporary numbers are routed to higher scrutiny instead of being accepted by static thresholds.

Key takeaways

• Phone numbers no longer function as durable proof of identity in recovery or authentication flows when reassignment and virtual provisioning are common.
• The key failure is not SMS delivery, but the assumption that reachability still equals ownership and continuity.
• Fraud and IAM teams need policy that reacts to reassignment, churn, and temporary use instead of relying on static phone tenure checks.

Key terms

• Recycled Phone Number Fraud: Fraud that exploits the reassignment of previously used phone numbers. A number can still appear reachable and legitimate after ownership changes, allowing attackers to pass SMS-based checks and exploit trust built by the previous owner.
• eSIM Abuse: The misuse of software-provisioned mobile identities to create, rotate, or discard phone access quickly. It lowers the cost of abuse because attackers can change numbers and devices in software, weakening controls that assume long-lived ownership.
• Ownership Continuity: The ability to show that a phone number still belongs to the same user over time. It is stronger than reachability because it includes disconnects, reassignment, tenure, and churn signals, which are essential for trustworthy authentication and recovery decisions.
• Phone-Based Recovery: Phone-based recovery is any identity reset or account recovery flow that uses a phone number to send codes, links, or callbacks. It is convenient, but it becomes a high-risk control when the number can be recycled and the recovery path outlives the original trust relationship.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management in the contexts that shape modern access decisions. It helps security and identity practitioners connect governance controls to real-world identity risk.