Who is accountable when recycled numbers lead to account takeover?

Why This Matters for Security Teams

Recycled numbers are not just a telephony problem. They become an identity recovery failure when SMS, voice, or callback flows continue to treat a reassigned number as proof of control. That puts account owners, IAM teams, and product teams in the same accountability chain because the risk sits in lifecycle governance, not just the end user’s caution. OWASP’s Non-Human Identity Top 10 is a useful reminder that weak trust paths are frequently embedded in recovery design, not only in primary authentication.

NHI Management Group research shows how often weak lifecycle controls persist: only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them. The same governance gap appears when a phone number is reassigned but still functions as an account recovery factor, creating a stale trust edge. The issue is not whether a user once owned the number, but whether the system keeps honouring obsolete evidence of ownership. In practice, many security teams encounter takeover only after the number has been recycled and the recovery path has already been abused.

How It Works in Practice

account takeover via recycled numbers usually follows a predictable sequence: a customer changes carriers, the previous number is reassigned, and a new holder receives reset codes or voice callbacks that still map to the old account. If recovery relies on SMS alone, the attacker does not need to defeat the primary password. They only need to exploit a trust path that was never revoked. That is why lifecycle controls matter as much as authentication controls.

Security teams should treat phone numbers like any other mutable identity attribute. Current guidance suggests reducing their role to a low-assurance signal and layering stronger controls for recovery. A better design uses risk-based checks, step-up verification, and out-of-band confirmation tied to a durable identity anchor such as a verified device, passkey, or customer support workflow. NIST’s SP 800-53 Rev. 5 supports this approach through access control, identification, authentication, and audit requirements, while the OWASP guidance above highlights why recovery paths deserve the same scrutiny as login paths.

• Revoke phone-based recovery when number ownership changes or verification ages out.
• Use short-lived recovery tokens instead of broad SMS reset trust.
• Log and alert on repeated recovery attempts from newly reassigned numbers.
• Require stronger proof for high-risk actions, especially when account email or device also changed.

For lifecycle discipline, NHI Management Group’s NHI Lifecycle Management Guide and Top 10 NHI Issues both reinforce the same operational point: trust must expire when the underlying asset changes. These controls tend to break down when carriers reassign numbers quickly and the application still treats stale recovery factors as authoritative.

Common Variations and Edge Cases

Tighter recovery controls often increase support friction, requiring organisations to balance account security against customer experience and fraud review volume. That tradeoff is real, especially in consumer apps where password resets are frequent and support teams are already overloaded. There is no universal standard for this yet, but best practice is evolving toward risk-tiered recovery rather than one-size-fits-all SMS reset.

Edge cases matter. Prepaid numbers can be reassigned faster than enterprise IT expects. Family-shared numbers may never have been a reliable ownership signal in the first place. Ported numbers can also remain linked to legacy accounts longer than the business assumes. In these environments, the safer approach is to treat the phone number as a weak, mutable attribute and not a durable identity proof. When recovery risk is high, organisations should prefer device-bound credentials, passkeys, verified support interaction, or step-up checks that do not depend on telecom ownership.

NHI Management Group’s Ultimate Guide to NHIs also frames the broader lesson: static trust does not survive lifecycle change. Once a number is recycled, the old assurance is gone, and any system still accepting it has kept a stale trust path alive.

Related resources from NHI Mgmt Group

• Why do recycled numbers and eSIM abuse increase account takeover risk?
• Why do passkeys reduce account takeover risk more effectively than OTP?
• When does a service account become a compliance problem?
• Who is accountable when a vishing attack leads to account takeover?