They create risk because the control follows the number, not the person. When numbers are recycled, ported, or reassigned, the next subscriber can receive verification codes and recovery messages intended for the previous owner. This makes phone-number trust fragile for identity assurance and especially dangerous where the same number unlocks multiple accounts or services.
Why This Matters for Security Teams
Phone-number based login is risky because it turns a telecom attribute into an identity proof, even though numbers are mutable, recycled, ported, and frequently exposed during support flows. That creates a direct path to account takeover when SMS codes, recovery links, or step-up checks follow the number instead of the person. NIST’s Cybersecurity Framework 2.0 emphasises resilient identity and access controls, but phone-number trust often sits outside that model.
NHI risk is not theoretical. NHI Management Group notes in its Ultimate Guide to NHIs — Why NHI Security Matters Now that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, showing how brittle identity shortcuts become once attackers find a reuse path. Phone-based login is weaker than many teams assume because the security boundary is a telephone carrier process, not a controlled identity lifecycle. In practice, many security teams discover the weakness only after a number port, recycled SIM, or support desk exception has already led to unauthorized access.
How It Works in Practice
The core failure is that SMS login and phone recovery treat possession of a number as proof of account ownership. That works only as long as the number remains tightly bound to one person, one device, and one carrier state. In reality, numbers are reassigned, transferred, pooled, and sometimes recovered through social engineering or weak carrier procedures. Once an attacker gains control of the number, they can receive one-time codes, reset passwords, and bypass MFA if the phone number is the fallback factor.
This is why current guidance increasingly favours stronger identity primitives, such as phishing-resistant MFA and recovery methods that do not rely on a mutable telecom endpoint. NIST SP 800-53 Rev. 5, especially access control and identification controls, supports designing authentication around assurance, not convenience. For operational context, NHI Management Group’s Top 10 NHI Issues highlights how identity trust breaks down when lifecycle events are not tightly governed.
- Use phone numbers only as a contact attribute, not as the root of authentication.
- Prefer app-based or hardware-backed authenticators for primary and recovery flows.
- Remove SMS from account recovery where the account protects sensitive data or administrative privileges.
- Apply step-up verification with risk signals, not static trust in a number.
- Review carrier-facing processes, because port-out and reassignment are outside your IAM stack.
For organisations that must retain SMS, best practice is evolving toward time-bound, high-friction verification and layered monitoring, but there is no universal standard for this yet. These controls tend to break down in high-volume consumer environments because support pressure encourages fallback to the easiest recovery path.
Common Variations and Edge Cases
Tighter account recovery often increases user friction and help desk load, requiring organisations to balance fraud resistance against reset speed. That tradeoff becomes sharper for consumer apps, shared devices, and markets where SMS is the only broadly available factor. In those cases, phone-number login may still be used as a low-assurance convenience layer, but it should not be the sole control protecting financial, administrative, or recovery-sensitive accounts.
There is also an important exception: a phone number can be one signal in a broader risk engine, but it should not function as an authoritative identity claim on its own. For higher-risk services, the better pattern is to bind the account to a durable authenticator, then treat the number as a changeable contact channel. That is consistent with the direction of modern identity assurance and with OWASP NHI Top 10 guidance on reducing trust in weak, externally managed secrets and recovery paths. For a broader security lens, the Ultimate Guide to NHIs — Key Challenges and Risks shows how weak lifecycle control turns identity plumbing into an attack surface.
In regulated environments, especially where account takeover has direct fraud impact, the safer answer is to phase out phone-number based authentication entirely. Where legacy systems remain, teams should at minimum require independent verification for number changes, resets, and recovery.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC | Phone-number login is an access control weakness when it becomes a primary identity proof. |
| NIST SP 800-63 | Digital identity guidance is relevant because SMS recovery offers low assurance. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | Weak secret and credential lifecycle handling mirrors SMS-based takeover risk. |
| NIST AI RMF | Trustworthy identity and accountability are core AI risk management concerns. | |
| NIST SP 800-53 Rev 5 | IA-2 | Authentication strength directly governs whether a phone number can unlock access. |
Treat phone numbers as mutable contact data and use stronger access controls for authentication and recovery.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
