Topic starter
11/07/2026 8:22 pm
TL;DR: Mobile-number recycling can hand a new subscriber access to accounts tied to the previous owner when authentication depends on the number alone, according to IDlayr. SMS OTP and recovery flows that ignore SIM-level verification create account takeover risk, fraud exposure, and reputational damage.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “L'ENORME problema dell'identità e del login da mobile - Numeri riciclati”.
Key questions
Q: What breaks when a mobile number is recycled in account recovery flows?
A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership.
Q: Why does SMS OTP create higher takeover risk when phone numbers are reused?
A: Because SMS OTP proves reachability of the number, not stable ownership of the SIM or account.
Q: How should organisations reduce dependence on SMS for identity verification?
A: Move privileged users to phishing-resistant methods, use number-change detection as a gating control, and require a separate authoritative proofing step for any high-risk reset or recovery.
Practitioner guidance
- Replace number-only recovery with stronger verification Require an additional possession or subscriber check before password reset, account recovery, or high-risk profile changes.
- Validate SIM-level binding before step-up authentication Check whether the current SIM or subscriber relationship matches the enrolled mobile identity before sending sensitive OTP or recovery flows.
- Remove SMS OTP from high-risk workflows Use safer factors for banking, healthcare, and other accounts where number recycling could expose regulated or financially sensitive data.
Bottom line: Recycled mobile numbers can transfer access to the wrong person when identity systems rely on the phone number as the primary recovery anchor.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:52 pm
Mobile number recycling exposes an identity binding failure, not just an authentication weakness. The article shows that when a phone number is reused, the system’s implicit promise of continuity no longer holds. That breaks the assumption that a recovery factor still belongs to the original subscriber, and it turns phone-number identity into a time-sensitive trust relationship rather than a durable control. Practitioners should treat number reissue as a governance boundary, not a routine telecom event.
A question worth separating out:
Q: When should teams stop trusting SMS OTP for sensitive accounts?
A: They should stop relying on SMS OTP whenever the account holds financial, healthcare, or other sensitive data, or whenever number reuse is common in the target market. In those settings, SMS is too weak to stand alone as a recovery or step-up factor.
👉 Read our full editorial: Mobile number recycling exposes a fragile identity trust model