TL;DR: Recycled phone numbers let fraudsters inherit dormant account links, bypass SMS OTP recovery, and impersonate prior owners, according to Prove Identity. The core issue is not the number itself but the trust model that treats tenure as proof of current ownership, which breaks once reissuance occurs.
At a glance
What this is: Recycled phone numbers create a phone-based identity gap where historical trust survives reissue and can be abused for account recovery, impersonation, and account takeover.
Why it matters: IAM and fraud teams need to treat phone number ownership as a live state, not a historical attribute, because SMS-based recovery and verification break when reissued numbers retain old trust links.
Context
Recycled phone numbers are numbers that were once assigned to one user, then released and reissued to someone else. In identity systems, that matters because many organisations still treat phone tenure as a proxy for current ownership.
The governance problem is not the carrier process itself. It is the way phone-based authentication, recovery, and fraud controls keep trusting a number after its ownership has changed, which creates a gap between historical reputation and present control.
For IAM, fraud, and customer identity programmes, this is a lifecycle problem as much as an authentication problem: the authenticator can change hands outside the organisation's visibility, while account links and recovery paths remain intact.
Key questions
Q: What fails when a recycled phone number is still trusted for account recovery?
A: The recovery flow fails because the organisation is trusting a number's history instead of the current subscriber's control of it. That lets a new owner receive one-time codes, reset passwords, and inherit dormant account links that were never revalidated after reissue.
Q: Why do recycled phone numbers create fraud risk for SMS OTP and password reset flows?
A: They create fraud risk because SMS delivery proves access to the number, not rightful ownership of the identity behind it. If old recovery bindings remain active after reissue, a fraudster can receive codes intended for the previous owner and complete account takeover.
Q: What are the signs that remote identity verification is too weak?
A: Common signs include high manual review rates, repeated document resubmission, inconsistent identity data, and customer records that later trigger sanctions or fraud exceptions. Another warning is when onboarding teams rely on document authenticity as the main proof of identity instead of checking live presence. Those patterns show the process is verifying paperwork, not people.
Q: Should teams replace SMS verification with stronger ownership checks for phone numbers?
A: Yes, for high-risk actions. SMS can still be one signal, but it should not be the sole proof of identity when numbers can be recycled. Teams should require current ownership verification and additional risk signals before allowing reset, transfer, or payout actions.
Technical breakdown
Why recycled numbers break phone-based authentication
Phone-based authentication assumes the person who receives the SMS code controls the number. Recycled numbers break that assumption because the number can move from a legitimate user to a new subscriber while old account links, recovery settings, and reputation signals remain attached. The result is a false continuity of trust: the system sees a familiar number, but the human behind it has changed. This is especially dangerous where SMS OTP or phone reset flows are treated as a primary recovery path, because possession of the number becomes enough to reset access.
Practical implication: treat number ownership as an active verification state, not a permanent property of the account.
How dormant account links become fraud entry points
When users fail to update old accounts after changing numbers, the recycled number retains a trail of dormant recovery paths across banks, social platforms, loyalty schemes, and shopping accounts. A fraudster who acquires that number can exploit those stale links to request resets, intercept one-time codes, and pivot into account takeover. The technical weakness is not just SMS delivery. It is the persistence of orphaned identity bindings that never got revalidated when the authenticator changed hands.
Practical implication: inventory recovery pathways that still depend on phone numbers and remove stale phone bindings from high-risk accounts.
Why tenure-based reputation is not enough
Many legacy checks still rely on number age or tenure as a proxy for trust. That model fails because recycled numbers can appear established even when the current subscriber is unrelated to the original owner. The article also points to a stronger control pattern: combine reputation, real-time ownership verification, and device or network signals rather than using tenure alone. In practice, this shifts phone intelligence from a static lookup to a lifecycle-aware control surface.
Practical implication: stop using tenure as a stand-alone trust signal and require current ownership proof before high-risk actions.
Threat narrative
Attacker objective: The attacker wants to inherit the previous owner's trust relationships and use them to take over accounts or commit fraud under a legitimate-looking identity.
- Entry occurs when a fraudster acquires a recycled number that still carries dormant account ties from the previous owner.
- Credential access follows when the fraudster triggers password reset or SMS OTP flows that route codes to the newly acquired number.
- Escalation happens as the fraudster takes over accounts, changes recovery data, and locks out the original user.
- Impact includes account takeover, impersonation, fraudulent transactions, and exposure of personal data linked to the recycled number.
Breaches seen in the wild
- United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.
- Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phone-number tenure is not an identity control, it is a stale trust signal. The article shows that legacy systems often mistake historical ownership for current control, which creates a false sense of assurance around SMS-based authentication. That assumption collapses the moment numbering resources are reissued, because the control is measuring age, not possession. For identity programmes, the practical lesson is that phone number history cannot substitute for live ownership.
Recycled phone numbers create trust debt across the account lifecycle. The article's real finding is not merely that attackers can receive an OTP. It is that organisations accumulate dormant bindings to old numbers across recovery, contact, and notification flows, then leave those bindings ungoverned after reassignment. That makes lifecycle ownership the critical issue, and it is exactly where IAM and fraud teams must align their models.
Phone-based identity remains weak when the authenticator can change hands outside governance. Prove Identity's analysis shows a structural gap between the organisation's view of identity and the carrier's control over number reissue. The result is a control boundary problem, not just a fraud problem, because the authenticator's state changes without any corresponding identity event inside the enterprise. Practitioners should treat that mismatch as a governance defect, not an edge case.
Real-time ownership verification is the decisive control, not number reputation alone. A number can look trusted because it has history, but that history becomes misleading once the number is recycled. The article points toward a layered model that checks current ownership, device behaviour, and risk signals together. For practitioners, the field implication is that phone identity has to move from static scoring to current-state verification.
Ephemeral phone trust debt: The most useful concept in this article is the lag between a number's historical reputation and its present owner. That lag is what fraudsters exploit, because dormant trust survives reissue longer than the organisation's controls do. The conclusion for IAM and fraud teams is simple: any system that trusts phone tenure without current ownership proof is accepting hidden identity debt.
What this signals
Ephemeral phone trust debt: identity teams should assume that any phone number can outlive its original owner and still retain account bindings. The control problem is not SMS itself, but the failure to revalidate those bindings when ownership changes.
Fraud teams should treat recycled numbers as a lifecycle governance issue. When authenticator ownership can change outside the enterprise's visibility, recovery flows and contact-data updates need live ownership checks rather than historical reputation alone.
For practitioners
- Audit phone-based recovery paths Map every password reset, OTP, and account recovery flow that still treats a phone number as a strong authenticator. Prioritise high-value accounts where SMS can override other factors.
- Revalidate stale phone bindings Remove or challenge dormant phone links on accounts where the user may have changed numbers. Focus on accounts with long inactivity, failed login recovery, or repeated contact-data changes.
- Require current ownership proof Use live ownership checks before high-risk actions such as recovery, transaction approval, or contact-data updates. Do not rely on number age, tenure, or prior reputation as a stand-alone signal.
- Separate reputation from possession Combine number reputation, device behaviour, and real-time validation so that a number's history does not automatically confer trust to a new subscriber.
Key takeaways
- Recycled phone numbers expose a structural weakness in phone-based identity because historical trust can survive after ownership changes.
- The article shows how dormant recovery links, SMS OTP flows, and stale contact records create a practical path to account takeover and impersonation.
- The decisive response is to verify current ownership before trusting a phone number for recovery or high-risk actions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SMS OTP and phone-based recovery are treated as authentication in this article. |
| NHI-07 — Long-Lived Secrets | The article shows how long-lived phone bindings remain usable after ownership changes. | |
| NHI-10 — Human Use of NHI | A phone number is being used as a human identity factor even after it changes hands. | |
| Recommendation — Replace phone-number trust shortcuts with current ownership checks for high-risk authentication flows. Shorten the trust life of phone-based authenticators and revalidate them after number changes. Prevent phone numbers from acting as stable identity proof when the real owner can change outside governance. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle management is central when recycled numbers are used for recovery. |
| Recommendation — Apply authenticator management controls to phone-based factors and revoke stale recovery paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Stale phone bindings preserve authorisation paths that should no longer exist. |
| Recommendation — Review phone-linked recovery permissions and remove any entitlement that outlives ownership. | ||
| CIS Controls v8 | CIS-5 — Account Management | The issue is stale account and recovery data tied to a recycled authenticator. |
| Recommendation — Keep account recovery data current and disable phone-linked access when ownership changes. | ||
Key terms
- Recycled Mobile Number: A recycled mobile number is a phone number that has been disconnected from one subscriber and reassigned to another. In identity systems, reuse becomes a security problem when the old number still functions as a recovery or authentication signal for accounts tied to the previous owner.
- Phone-Based Authentication: A verification approach that uses a trusted phone number, device, or mobile-linked credential to confirm identity. In practice, it shifts trust away from the content of an email, call, or text and toward possession of an enrolled endpoint that was established through a controlled onboarding process.
- Dormant Account Binding: A dormant account binding is a stale link between an account and an authenticator that is no longer actively maintained by the user or organisation. These bindings create hidden recovery paths when they are not removed after a number change or other lifecycle event.
- Current Ownership Verification: Current ownership verification checks who controls a phone number right now, not who controlled it in the past. For phone-centric identity, this is the difference between a static reputation signal and a live control that can stop recycled-number fraud.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org