A recycled phone number is a telephone number that has been disconnected from one user and reassigned to another. In identity systems, it can create account takeover risk when SMS-based recovery, OTP delivery, or multi-factor authentication still trusts the number after reassignment, exposing accounts to unintended access.
What a recycled phone number means for account security
A recycled phone number is dangerous because phone numbers are often treated as proof of continuity, even after reassignment. When a bank, cloud service, or consumer platform still treats the number as belonging to the original user, an attacker who receives that number can intercept recovery flows and one-time passcodes.
The core security problem is not the telephone network itself, but the trust many systems place in SMS as an identity recovery or step-up channel. If the number becomes stale in an account record, the service may continue to route authentication events to the wrong person, turning a normal telecom lifecycle event into an access-control failure.
Why recycled numbers create takeover risk
Reassignment becomes risky when the phone number is used as a recovery factor, account lookup key, or fallback contact method. A recycled number can let a new holder reset passwords, receive verification codes, or satisfy a legacy verification step that was never designed to detect number churn.
The threat is especially serious when the number protects sensitive accounts that gate email, payroll, finance, or administrator access. If an attacker can enter through the recycled number path, they may inherit password reset privilege without ever knowing the original secret.
How organisations should assess exposure
Exposure starts with inventory: identify every place a phone number is stored, displayed, or used as an authenticator or recovery attribute. Services with SMS-based password reset, helpdesk verification, or contact-based step-up checks deserve the closest review because they are most likely to trust a reassigned number.
Organisations should also ask whether the number is visible outside the trusted account record, reused across many systems, or retained long after the user relationship ends. Those conditions make stale-number risk harder to spot and easier to exploit.
How to reduce reliance on recycled numbers
Reduce exposure by treating phone numbers as mutable contact data, not durable proof of identity. Stronger recovery design relies on phishing-resistant authenticators, verified in-session re-enrollment, and recovery paths that do not depend on a single telephone number staying under one person’s control.
Where SMS cannot be removed immediately, use it as a weak, transitional signal rather than a sole recovery factor, and re-verify the number before allowing sensitive changes. Service owners should also build processes for number change, account inactivity, and recovery attribute refresh so old numbers do not remain trusted indefinitely.
Risk and Threat Considerations
Recycled numbers create a direct account takeover path because the new holder of the number may receive password reset messages, one-time passcodes, or helpdesk callbacks intended for someone else. The danger grows when the number is used for high-value accounts or when the service treats possession of the number as sufficient proof of continuity.
Failure mechanism: The account retains an outdated phone number, and authentication or recovery workflows continue to trust that number after telecom reassignment. An attacker who inherits the number can then intercept the reset or verification step and pivot into the protected account.
Impact: Unauthorized account recovery, session theft, mailbox compromise, and downstream access to systems that trust the compromised account for further resets or approvals can follow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-63, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Recycled numbers affect management and rotation of recovery authenticators and phone-based verification material. |
| IA-2 — Identification and Authentication (Organizational Users) | The term concerns authentication paths that may wrongly identify a user through a reassigned number. | |
| Recommendation — Review and expire phone-based recovery methods when the number changes or is no longer reliably bound to the user. Require stronger user authentication than SMS possession before allowing account recovery or step-up access. | ||
| NIST SP 800-63 | Digital Identity Guidelines | NIST 800-63 directly addresses authenticator assurance and recovery design relevant to SMS-based identity proofing and resets. |
| Recommendation — Prefer phishing-resistant authenticators and avoid using a recycled phone number as the sole recovery factor. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management | Recycled-number risk is an identity and access control failure affecting account recovery and verification. |
| Recommendation — Map phone-number use in recovery flows and replace weak trust assumptions with stronger access controls. | ||
| OWASP ASVS | V6 — Authentication | SMS-based reset and verification logic are authentication mechanisms that can fail when the number is recycled. |
| Recommendation — Test reset and step-up flows so a changed phone number cannot authenticate a new holder of the number. | ||
Practitioner Guidance
What to watch for: The biggest warning sign is any workflow that still uses SMS as the deciding factor for recovery or sensitive change approval. If a number change, inactivity event, or failed delivery does not force re-verification, the service is likely over-trusting stale contact data.
Governance implication: Ownership of phone-number trust should sit with the team that owns account recovery, not with telecom operations or support alone. The account lifecycle needs a clear rule for when a number stops being authoritative and what stronger check replaces it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org