Topic starter
11/07/2026 8:22 pm
TL;DR: Recycled mobile numbers can redirect account access to a new subscriber when recovery still treats the phone number as proof of ownership, according to IDlayr. Mobile identity systems need a separate re-verification step when a number is reassigned, or SMS OTP can route trust to the wrong person.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “L'ENORME problema dell'identità e del login da mobile - Numeri riciclati”.
Key questions
Q: Why does SMS OTP create higher takeover risk when phone numbers are reused?
A: Because SMS OTP proves reachability of the number, not stable ownership of the SIM or account.
Q: How should organisations reduce dependence on SMS for identity verification?
A: Move privileged users to phishing-resistant methods, use number-change detection as a gating control, and require a separate authoritative proofing step for any high-risk reset or recovery.
Q: What breaks when a mobile number is recycled in account recovery flows?
A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership.
Practitioner guidance
- Replace number-only recovery with stronger verification Require an additional possession or subscriber check before password reset, account recovery, or high-risk profile changes.
- Validate SIM-level binding before step-up authentication Check whether the current SIM or subscriber relationship matches the enrolled mobile identity before sending sensitive OTP or recovery flows.
- Remove SMS OTP from high-risk workflows Use safer factors for banking, healthcare, and other accounts where number recycling could expose regulated or financially sensitive data.
Bottom line: Recycled mobile numbers can transfer access to the wrong person when identity systems rely on the phone number as the primary recovery anchor.
Glossary terms: Mobile Number Recycling, SIM Binding, Sms Otp, Identity proofing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/07/2026 8:52 pm
Mobile number recycling exposes an identity binding failure, not just an authentication weakness. The article shows that when a phone number is reused, the system’s implicit promise of continuity no longer holds. That breaks the assumption that a recovery factor still belongs to the original subscriber, and it turns phone-number identity into a time-sensitive trust relationship rather than a durable control. Practitioners should treat number reissue as a governance boundary, not a routine telecom event.
A question worth separating out:
Q: When should teams stop trusting SMS OTP for sensitive accounts?
A: They should stop relying on SMS OTP whenever the account holds financial, healthcare, or other sensitive data, or whenever number reuse is common in the target market. In those settings, SMS is too weak to stand alone as a recovery or step-up factor.
👉 Read our full editorial: Mobile number recycling exposes a fragile identity trust model