Topic starter
11/07/2026 8:39 pm
TL;DR: Recycled mobile numbers can route SMS login and recovery codes to new subscribers, IDlayr finds, so ownership of the number can no longer prove entitlement to the account. SMS-based recovery should treat the phone number as mutable contact data, not a stable identity factor.
Editorial analysis by NHI Mgmt Group, based on content published by IDlayr: “El ENORME problema de la identidad e inicio de sesión a través del móvil - Recycled Numbers”.
By the numbers:
- In the United Kingdom, mobile providers often recycle numbers within 70-180 days.
- A study of 259 recycled numbers found that 215 were still vulnerable to exploitation.
Key questions
Q: Why does SMS OTP become unsafe when number ownership changes?
A: SMS OTP depends on the number, not on verified SIM ownership or stable identity binding.
Q: How can security teams reduce risk from recycled mobile numbers?
A: Teams should verify the live relationship between the number and the active SIM before allowing login or recovery, and they should reserve SMS for low-assurance use cases.
Q: What breaks when a mobile number is recycled in account recovery flows?
A: Account recovery breaks when a recycled number becomes a new subscriber’s routing destination while systems still treat it as proof of ownership.
Practitioner guidance
- Audit every SMS-based recovery path Map where phone numbers are used for password reset, step-up authentication, and account recovery, then identify which of those flows can unlock financial, health, messaging, or e-commerce access.
- Bind mobile identity to the active SIM Require checks that the number and current SIM state still align before issuing access or recovery tokens, especially where the account can be reused after a number change.
- Remove SMS-only trust from high-impact accounts Move the highest-risk journeys away from number-only verification and reserve SMS for low-assurance notifications rather than account recovery or login proof.
Bottom line: Recycled mobile numbers expose a trust gap in SMS-based identity flows because the number can outlive the account holder.
Glossary terms: Recycled Mobile Number, SIM Binding, Sms Otp, Identity Binding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
11/07/2026 9:07 pm
Phone-number trust is an identity binding failure, not a messaging failure: The article shows that SMS OTP can still deliver a code correctly while failing the security objective entirely. The control problem is that the number is being treated as evidence of account ownership even after reassignment. For identity programmes, that means the binding layer is the real control surface, not the text message itself.
A question worth separating out:
Q: When should organisations stop trusting mobile numbers as an authentication factor?
A: They should stop relying on mobile numbers whenever the account can unlock sensitive data, financial services, or recovery of other credentials. A phone number is a mutable contact attribute, not a durable proof of identity.
👉 Read our full editorial: Mobile identity risk from recycled numbers breaks login trust