They create fraud risk because SMS delivery proves access to the number, not rightful ownership of the identity behind it. If old recovery bindings remain active after reissue, a fraudster can receive codes intended for the previous owner and complete account takeover.
Why recycled phone numbers turn SMS OTP into an identity-recovery problem
SMS OTP looks like a proof-of-possession control, but recycled numbers break the assumption that the current phone owner is the same person who enrolled the number. Once a carrier reissues the line, delivery can succeed for the wrong person, so the control is no longer verifying identity, it is only verifying reachability of a live phone number.
That distinction matters because recovery flows often treat an OTP as a high-confidence step for access restoration. If the number is still bound to the account, the new holder can receive reset codes, intercept recovery messages, or satisfy step-up prompts that were meant to protect the previous owner.
Two design choices make the risk worse: long-lived recovery bindings and weak re-verification at reset time. If the system does not notice that the number has been reassigned, the OTP can become a stale credential path rather than a current authenticator.
Where password reset flows fail after number reassignment
Password reset flows are especially sensitive because they are often the easiest path to account takeover after the password itself is forgotten or lost. When SMS is used as the reset factor, the attacker does not need the old password, only access to the recycled number and an account that still trusts it.
That creates a classic recovery weakness: the channel used to restore access becomes the same channel an attacker can exploit once the number is recycled. In practice, the problem is not the SMS transport, it is the stale trust relationship between the account and the telephone number.
Systems that rely on SMS for both OTP and reset verification also create concentration risk. One weak binding can expose login, recovery, and support-assisted reset paths at the same time, which turns a single reassigned number into a broad account compromise vector.
What secure teams should change in the recovery design
SMS should be treated as a low-assurance, fallback channel, not as the primary proof of account ownership. The safer pattern is to require stronger authenticators for account recovery, re-check recovery contact information before activation, and invalidate old recovery bindings when a number changes or goes stale.
Account recovery should also be designed so that possession of a phone number does not, by itself, authorize a reset of a valuable account. For a deeper practitioner view on recovery controls, see the Account Recovery and Help Desk Security Guide, which focuses on secure reset design and caller verification.
When evaluating MFA strategy, the MFA Guide is useful for comparing SMS OTP with phishing-resistant options such as passkeys and security keys. The broader Workforce Identity Security Guide also covers account recovery and help desk reset paths that often become the real failure point.
Risk and Threat Considerations
Recycled numbers create a takeover window whenever a provider reassigns a line faster than an organisation retires or revalidates the number in its identity systems. That makes SMS-based recovery attractive to opportunistic attackers, SIM-swap-style fraud, and social engineering that targets support teams already conditioned to trust the number on file.
Failure mechanism: The application or help desk continues to trust a phone number after the carrier has reassigned it, so OTPs and reset codes go to a new holder who can satisfy a recovery step without owning the underlying account.
Impact: An attacker can intercept password reset codes, complete account recovery, and pivot into email, financial, or enterprise accounts that still treat SMS delivery as evidence of rightful access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | SMS OTP and reset flows hinge on user authentication assurance. |
| IA-5 — Authenticator Management | Recycled numbers expose authenticator lifecycle and stale binding problems. | |
| IA-8 — Identification and Authentication (Non-Organizational Users) | Password reset flows for external users depend on reliable identity proofing and recovery. | |
| Recommendation — Replace SMS-only recovery with stronger, higher-assurance authentication for privileged and high-value accounts. Inventory, revalidate, and revoke phone-based authenticators when their ownership changes. Use stronger proofing and recovery controls before allowing reset of external accounts. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The question concerns authenticator assurance and recovery trust decisions. |
| Recommendation — Use higher-assurance authenticators and recovery rules instead of SMS as the decisive factor. | ||
Practitioner Guidance
What to verify: Check whether phone numbers used for reset or OTP are revalidated on a schedule, on SIM or carrier change signals, or only when the user manually updates them. If the answer is “only at enrollment,” treat the reset path as stale.
Decision rule: If a phone number can unlock account recovery, do not let it be the sole recovery factor for high-value accounts. Require an additional bound authenticator or a higher-trust verification path before the reset completes.
What good looks like: The account can detect stale contact data, revoke old recovery bindings promptly, and force step-up proofing before a number change becomes a recovery credential again. For identity and reset processes, the safest default is that delivery success is never treated as ownership proof.
Practitioner takeaway: SMS OTP is vulnerable here because the control measures reachability, not enduring identity, so the real fix is to weaken SMS’s role in recovery and strengthen how the system re-establishes trust before it grants access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 13, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org