Recycled mobile numbers expose account takeover risk

At a glance

What this is: This article argues that recycled mobile numbers create account takeover and fraud risk when services treat a phone number as proof of identity after it has been reassigned.

Why it matters: It matters because IAM teams, fraud leads and customer identity owners need to stop equating number possession with account ownership, especially where SMS-based recovery and OTP still gate access.

By the numbers:

• In the United States, roughly 35 million phone numbers are recycled annually.
• A study of 259 recycled numbers found that 215 were indeed recycled and remained vulnerable to exploitation.

Context

Using a mobile number as an identity credential looks convenient, but it creates a governance gap when the number is disconnected, recycled and reassigned to someone else. In that state, the number still reaches the new holder even though the original account relationship has changed.

This problem sits squarely in human IAM and customer identity, not in NHI governance. The weak point is the trust model around SMS recovery and OTP, where possession of a number is treated as if it still proves ownership.

The article’s central claim is simple: if the verification layer does not bind the number to the SIM and active subscriber identity, account recovery can drift away from the rightful user within weeks or even sooner.

Key questions

Q: What breaks when a mobile number is recycled in account recovery flows?

A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership. Password resets, SMS OTP and linked-service notifications can reach the wrong person, enabling account takeover and fraud. The control failure is the assumption that possession of the number still equals entitlement to the account.

Q: Why do recycled mobile numbers create identity risk for IAM programmes?

A: They create identity risk because the lifecycle of the phone number is separate from the lifecycle of the account. If a number is reassigned, the old trust relationship survives in systems that still rely on it for recovery or step-up. IAM teams need to treat number reuse as a trust revocation event, not as routine contact maintenance.

Q: What are the signs that SMS-based account recovery is failing?

A: Look for password resets, OTP delivery and recovery flows that succeed without confirming SIM continuity or active subscriber binding. Another sign is shared phone-number recovery across multiple services, which lets one reassigned number unlock a wider set of accounts than the business intended.

Q: Should organisations replace SMS OTP before changing their broader identity stack?

A: Yes, if recycled-number exposure is already creating recovery risk. SMS OTP is often the weakest link in account recovery because it assumes number ownership is stable. Teams should prioritise the highest-risk journeys first, especially banking, wallet and messaging use cases, then harden the rest of the recovery model.

Technical breakdown

Why recycled numbers break SMS-based verification

SMS OTP and password-reset flows assume the phone number still belongs to the original user. When a mobile network operator recycles that number, messages and recovery codes go to the new holder instead. The failure is not SMS delivery itself, but the fact that the verification step confuses reachability with identity proof. That makes the number a mutable contact point rather than a stable authenticator. In practice, any account recovery design that treats the MSISDN as standalone proof of ownership inherits this failure mode the moment reassignment occurs.

Practical implication: treat number possession as a weak signal unless it is paired with a stronger subscriber binding.

How SIM binding changes the trust model

A SIM binding model checks the relationship between the mobile number, the SIM card and the subscriber identity. The article points to identifiers such as ICCID and IMSI as the linkage that distinguishes the active SIM from a recycled number. This shifts verification away from static number ownership and toward live subscriber state. If the number changes hands, the binding should fail and force re-verification before access is granted. That is a different control posture from SMS OTP, which only tests where a message can be delivered.

Practical implication: verify the number against SIM and subscriber state before allowing recovery or login.

Where account takeover chains begin after reassignment

Recycled-number abuse often starts with password reset or SMS code interception, then expands into messaging apps, bank accounts, digital wallets and other linked services. The attack path is opportunistic rather than highly technical, which is why the governance failure matters more than the exploitation method. Once one service accepts the recycled number as proof of ownership, the new holder can pivot into adjacent accounts that reuse the same recovery channel. The issue is therefore cross-service trust reuse, not just weak authentication at a single app boundary.

Practical implication: inventory every service that accepts phone-number recovery and remove silent cross-account trust.

Threat narrative

Attacker objective: The attacker or unintended new holder gains control of the previous user’s accounts and any linked services that still trust the recycled number.

1. Entry occurs when a mobile network operator recycles an inactive number and assigns it to a new user.
2. Credential access happens when password resets, SMS OTP or linked-service recovery messages are delivered to the new holder.
3. Escalation follows as the new holder uses that access to enter messaging, financial or other connected accounts.
4. Impact is account takeover, fraud, privacy exposure and reputational damage to the business that trusted the recycled number.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Recycled-number exposure is an identity binding failure, not an SMS delivery problem: The control gap appears when recovery logic treats the phone number as if it still proves user ownership after reassignment. That assumption fails the moment a number is recycled, because possession of the line no longer maps cleanly to the original account holder. Practitioners should read this as a human identity governance issue, not a telecom edge case.

SMS OTP creates false confidence in account recovery: The article shows that OTP delivery can remain technically functional while the underlying trust claim is already broken. That distinction matters because a working channel is not the same as a trustworthy channel. Identity teams should separate message reachability from proof of account control.

Live subscriber binding should replace static number trust: The article’s strongest concept is the live trust link between number, SIM and verified identity. That is the right framing for mobile identity in customer-facing programmes, because it forces verification to fail when ownership changes rather than silently persisting across reassignment. The implication is that recovery assurance must move from number possession to active subscriber state.

Cross-service trust reuse is the real blast radius: Once a recycled number works in one app, adjacent services often inherit the same recovery assumption. That creates a cascading account-takeover path across social, banking and messaging ecosystems. Practitioners should treat phone-number recovery as a shared trust dependency, not an isolated application setting.

Mobile identity governance now sits between IAM and fraud control: This topic is no longer just about login convenience or user experience. It affects account recovery policy, fraud prevention, privacy exposure and customer trust at the same time. Teams that own identity journeys should govern recycled-number risk as a core control-plane issue, not a niche exception.

What this signals

Live subscriber binding is the control that matters: Identity programmes should stop treating a mobile number as a stable secret and start treating it as a mutable contact point. The control question is whether recovery depends on number possession or on verified subscriber state, because only the latter breaks cleanly when reassignment happens.

Recycled numbers expand the blast radius of weak recovery design: Once a number is reused, any account that still trusts it can become reachable by someone else. That means the real governance issue is not one bad OTP event, but the accumulation of shared recovery dependencies across consumer journeys.

Identity teams should classify recycled-number exposure alongside account recovery and fraud controls, not leave it buried inside channel preferences. Where a phone number still unlocks access, the recovery design is already assuming more trust than the identity proof can support.

For practitioners

• Harden phone-number recovery flows Require a second factor that is not derived from the recycled number before allowing password reset or account takeover-sensitive changes.
• Bind number checks to SIM state Verify the MSISDN against SIM-linked subscriber state so recycled or transferred numbers fail before access is granted.
• Review every SMS OTP dependency Map all login, recovery and step-up flows that still treat SMS OTP as proof of ownership, then replace the highest-risk ones first.
• Segment high-risk account recovery Use stricter recovery paths for banking, wallet, health and messaging accounts because recycled-number abuse can pivot across those services.

Key takeaways

• Recycled mobile numbers create a human identity governance problem when services keep using number possession as evidence of account ownership.
• The article cites 35 million recycled numbers annually in the United States and a 259-number study where 215 remained vulnerable, showing the scale of the exposure.
• The practical control move is to bind recovery to SIM-linked subscriber state and remove SMS OTP as a standalone proof of ownership.

Key terms

• Recycled Mobile Number: A recycled mobile number is a phone number that has been disconnected from one subscriber and reassigned to another. In identity systems, reuse becomes a security problem when the old number still functions as a recovery or authentication signal for accounts tied to the previous owner.
• SIM Binding: SIM binding is the practice of linking a mobile number to the active SIM or subscriber context that currently controls it. It strengthens assurance by checking more than message delivery, which helps detect number reassignment and prevents stale recovery paths from surviving ownership changes.
• Sms Otp: A one-time password delivered by text message and used as a possession-style second factor. It is widely deployed but increasingly treated as weak for high-risk access because the delivery channel can be intercepted, redirected or replayed outside the bank’s control.
• Account Recovery: Account recovery is the process used to restore access when a user cannot authenticate normally. In mature IAM programmes, recovery is treated as part of the trust chain because a weak reset path can bypass stronger login controls and become the easiest route to account takeover.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or IAM programme maturity, it is worth exploring.