Topic starter
11/07/2026 1:56 pm
TL;DR: Recycled numbers, eSIM abuse, and MVNO churn let fraudsters exploit account opening, authentication, and recovery flows, according to Prove Identity. Recovery and login decisions need continuity checks, not static tenure or SMS reachability assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by Prove Identity: “How Prove’s Global Fraud Policy Stops Phone-Based Fraud Others Miss”.
Key questions
Q: Why do recycled numbers and eSIM abuse increase account takeover risk?
A: Recycled numbers inherit historical trust, while eSIMs let attackers provision and discard phone identities quickly.
Q: How can security and fraud teams tell whether their controls are failing?
A: Look for two signals at once: rising false positives that push real customers away and rising fraud leakage that appears only after chargeback analysis.
Q: What breaks when a mobile number is recycled in account recovery flows?
A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership.
Practitioner guidance
- Separate ownership from reachability in phone policy Require decision logic that distinguishes a live phone number from a number that still belongs to the original customer.
- Tighten recovery around continuity checks Treat account recovery as a high-risk identity event and add policy checks for number tenure, recent ownership changes, and suspicious reuse patterns before allowing reset or step-up flows.
- Reduce reliance on SMS as a decisive factor Keep SMS in the flow only as one signal among others, and avoid using it as the sole proof of legitimacy for registration, authentication, or account recovery.
Bottom line: Phone numbers no longer function as durable proof of identity in recovery or authentication flows when reassignment and virtual provisioning are common.
Glossary terms: Recycled Phone Number Fraud, eSIM Abuse, Ownership Continuity, Phone-Based Recovery
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/07/2026 2:06 pm
Borrowed phone trust is now a governance problem, not a channel problem. The article shows that organisations are still treating phone numbers as durable identity anchors even though the underlying trust signal has become unstable. For IAM and fraud programmes, the issue is not whether SMS works, but whether the system can prove continuity of ownership at the moment of decision. The practitioner conclusion is that recovery governance must move from possession checks to ownership continuity.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: Should organisations treat SMS recovery differently from login authentication?
A: Yes. Recovery is usually a higher-risk decision because it can restore access after the original assurance has already been weakened. SMS may still be useful as one signal, but recovery should require stronger continuity evidence than routine login, especially where recycled numbers and eSIM provisioning are common.
👉 Read our full editorial: Phone-based fraud is breaking the trust model for account recovery