Topic starter
11/07/2026 8:28 pm
TL;DR: Recycled mobile numbers can hand password resets, SMS OTP and linked services to the wrong person after reassignment, creating account takeover, fraud and privacy exposure; the article cites 35 million recycled numbers annually in the United States and a 259-number study where 215 remained vulnerable, according to IDlayr. SMS-based trust assumptions fail when the number is no longer proof of ownership, making SIM-linked verification the decisive control.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “The HUGE issue with mobile-based identity & login – Recycled Numbers”.
By the numbers:
- In the United States, roughly 35 million phone numbers are recycled annually.
- A study of 259 recycled numbers found that 215 were indeed recycled and remained vulnerable to exploitation.
Key questions
Q: What breaks when a mobile number is recycled in account recovery flows?
A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership.
Q: Why do recycled mobile numbers create identity risk for IAM programmes?
A: They create identity risk because the lifecycle of the phone number is separate from the lifecycle of the account.
Q: What are the signs that SMS-based account recovery is failing?
A: Look for password resets, OTP delivery and recovery flows that succeed without confirming SIM continuity or active subscriber binding.
Practitioner guidance
- Harden phone-number recovery flows Require a second factor that is not derived from the recycled number before allowing password reset or account takeover-sensitive changes.
- Bind number checks to SIM state Verify the MSISDN against SIM-linked subscriber state so recycled or transferred numbers fail before access is granted.
- Review every SMS OTP dependency Map all login, recovery and step-up flows that still treat SMS OTP as proof of ownership, then replace the highest-risk ones first.
Bottom line: Recycled mobile numbers create a human identity governance problem when services keep using number possession as evidence of account ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:57 pm
Recycled-number exposure is an identity binding failure, not an SMS delivery problem: The control gap appears when recovery logic treats the phone number as if it still proves user ownership after reassignment. That assumption fails the moment a number is recycled, because possession of the line no longer maps cleanly to the original account holder. Practitioners should read this as a human identity governance issue, not a telecom edge case.
A question worth separating out:
Q: Should organisations replace SMS OTP before changing their broader identity stack?
A: Yes, if recycled-number exposure is already creating recovery risk. SMS OTP is often the weakest link in account recovery because it assumes number ownership is stable. Teams should prioritise the highest-risk journeys first, especially banking, wallet and messaging use cases, then harden the rest of the recovery model.
👉 Read our full editorial: Recycled mobile numbers expose account takeover risk