Phone Number Recycling and Account Takeover Guide

Mobile carriers give disconnected phone numbers to new subscribers, so a number stored on an account years ago may now belong to a stranger who receives that account's reset codes. Nobody has to attack the carrier for this to happen: number recycling is normal telecoms practice, and it quietly breaks every system that treats a phone number as a permanent, personal identifier. This guide explains how recycling works, what the research shows about the risk, how it differs from SIM swap, and what identity, fraud and product teams should change in sign-in, recovery and customer records. It is written for IAM and CIAM architects, fraud teams and anyone who owns an account recovery flow, with a short section for individuals changing numbers.

Key takeaways

A phone number is a lease, not an identity. In the US, carriers may reassign a permanently disconnected number after a minimum 45-day aging period, and the FCC estimates about 35 million numbers are disconnected each year.
Recycling defeats SMS recovery without any attack on the carrier. Princeton researchers found 171 of 259 available numbers they examined were still linked to accounts at major sites, and some new holders kept receiving one-time passcodes for the previous owner.
The worst design is SMS for both recovery and second factor. If a number can reset the password and also satisfy MFA, whoever holds the number holds the account.
Treat number tenure as a risk signal. Operator SIM swap APIs count a new subscription on a number as a SIM change, so a recent change before a sensitive action is a reason to step up, not to trust.
Re-verify and retire stale numbers. Periodic confirmation, at least two recovery routes and a phishing-resistant primary factor turn a recycled number from a takeover path into a support ticket.

How number recycling works

Telephone numbers are a finite national resource, so regulators expect carriers to reuse them. When a subscriber cancels service, stops paying a prepaid plan or ports out and then disconnects, the number goes through an aging period: the time between the subscriber losing the number and the number becoming available to someone else. In the United States the FCC rule at 47 CFR 52.15(f)(1)(ii) sets a minimum aging period of 45 days for disconnected numbers, a maximum of 90 days for residential numbers and up to 365 days for business numbers. Porting a number to another provider is not a permanent disconnection, so a port alone does not start the clock.

The aging period protects callers from reaching the wrong person on day one. It does nothing for the online accounts still pointing at the number. Banks, retailers, social networks, health portals and employers rarely learn that a customer has given up a number, so the record stays as it was. When the number is handed to a new subscriber, that person inherits the old owner's text messages, voice calls and, wherever SMS is accepted, their account recovery.

Messaging platforms see the same problem from the other side. WhatsApp, for example, says it treats a number as recycled when an account has been unused for 45 days and the number is then activated on a different device, at which point it removes the old profile photo and About text tied to the number. That is a sensible clean-up for one service; it shows how much the rest of the internet still depends on each service noticing on its own.

What the research shows

The most cited study is the 2021 Princeton work by Kevin Lee and Arvind Narayanan, which sampled 259 numbers offered to new subscribers by two large US carriers. Its findings are the clearest evidence that recycling is an account security problem and not just a privacy annoyance.

Finding	Figure reported	Why it matters
Numbers likely recycled and open to reverse lookup	215 of 259	Most numbers offered to new customers carried a previous owner's footprint
Numbers linked to an account at Amazon, AOL, Facebook, Google, PayPal or Yahoo	171 of 259	Recovery by SMS on those accounts was potentially available to the new holder
Numbers tied to email addresses in password breach dumps	100	A leaked password plus the number could satisfy SMS second factor without a reset
Numbers returning people-search results about prior owners	171	Personal details of the previous owner were easy to obtain
Recycled numbers still receiving sensitive messages within a week	19 of 200	Authentication passcodes and prescription reminders reached the wrong person
Recycled numbers available at one carrier	About one million, largely refreshed each month	The pool an attacker can browse is large and changing

The paper describes eight attacks. Three need no special skill: indexing numbers against people-search sites, hijacking accounts through SMS password reset, and combining a breached password with the number to pass SMS second factor. The others are targeted takeover (watching a specific person's old number and claiming it after aging ends), phishing new subscribers, persuading a new subscriber to give up a number with spoofed carrier messages, loading a number with spam before releasing it, and holding a number on an online service then demanding payment to release it. The researchers reported that carrier support staff gave inconsistent answers about recycling, and both carriers updated their public support pages in December 2020 to remind customers to update linked accounts before changing numbers.

Recycling, porting and SIM swap compared

All three move control of a number to someone other than the account holder, but they differ in intent, timing and what you can detect. The SIM swap path is covered in depth in the SIM Swap Fraud Guide; this table shows where recycling sits.

Event	Who controls the number afterwards	Is it fraud?	Typical gap before risk	Signals available to a relying service
Number recycling	A new, usually innocent subscriber	No, but it can be exploited deliberately	Weeks to years after the account holder stopped using the number	Recent SIM or subscription change on the line, failed delivery history, long account inactivity on the stored number
Port-out fraud	An attacker at another carrier	Yes	Minutes to hours	Recent port, carrier change, SIM change
SIM swap fraud	An attacker with a new SIM on the same carrier	Yes	Minutes to hours	Recent SIM change, device change
Legitimate new SIM or new phone	The genuine account holder	No	Not applicable	Same signals as fraud, which is why signals are inputs to a decision, not a verdict

Where a phone number is doing identity work it cannot do

A number proves that someone can receive messages on a line today. It does not prove who that person is, or that they are the person who registered it. Map every place your systems rely on it:

Login identifier: sign-in by phone number alone, common in consumer apps, makes the number the account key. A recycled number then collides with an existing account, so the new holder either takes it over or is blocked from signing up.
Second factor: SMS or voice one-time codes. NIST SP 800-63B-4 classes PSTN delivery as a restricted authenticator and says verifiers should consider risk indicators such as device swap, SIM change and number porting before sending a secret. See the NIST SP 800-63B-4 Authenticator Assurance Levels Guide.
Account recovery: a reset code by text is the highest-risk use, because it bypasses the password entirely. See the Account Recovery and Help Desk Security Guide.
Help desk verification: agents who call back "the number on file" or accept a code sent to it inherit the same weakness.
Deduplication and fraud linking: treating two accounts with the same number as the same person merges strangers and splits real customers who changed numbers.
Notifications: security alerts sent only by SMS go to the new holder, so the real owner never sees the warning that their account changed.
Workforce records: leavers' mobile numbers stay in HR and IAM systems as MFA methods and contact details long after the company line is returned to the carrier pool.

Controls for services that rely on phone numbers

Authentication and recovery design

Never allow SMS as both the reset path and the second factor: the Princeton paper calls this configuration doubly insecure. If SMS can reset the password, require a different factor to complete sign-in afterwards.
Offer and promote stronger factors: NIST SP 800-63B-4 Sec. 3.2.9 requires a credential service provider using a restricted authenticator to offer at least one unrestricted alternative, give meaningful notice of the risk and plan for migration. OWASP ASVS 5.0 requirement V6.6.1 says phone and SMS one-time codes should only be offered for previously validated numbers alongside stronger methods, and not at all for level 3 applications. See the Authenticator Apps and OTP Guide and Passkey account recovery.
Treat a number change as binding a new authenticator: NIST says setting or changing the pre-registered telephone number is the binding of a new authenticator, so it needs an existing authenticator, not just a code to the new number.
Keep at least two recovery and notification routes: NIST requires CSPs to allow at least two recovery addresses and support at least two notification addresses, and to notify the subscriber of every recovery. A recycled number then becomes one stale route, not the only one.

Number hygiene in customer and workforce records

Record when each number was last verified: store a verified-at timestamp, not just the number, and require re-verification through another channel when it is older than your threshold (NHI Mgmt Group recommendation: 12 months for accounts with payment or health data).
React to delivery failures: repeated undelivered messages are an early sign the line has been disconnected; flag the number as unverified rather than retrying.
Use dormancy as a trigger: an account dormant for months whose first action is an SMS reset is the classic recycled-number pattern. Step up to another factor or manual review.
Remove leaver numbers: make deletion of personal and corporate mobile numbers from MFA registrations part of offboarding. See the Employee Offboarding Security Guide.

Telecoms data you can use

SIM change checks: the Linux Foundation CAMARA project's SIM Swap API (release r4.3, sim-swap 2.2.0) offers a retrieve-date operation and a check operation with a maxAge window of 1 to 2,400 hours. Its definition states that a new subscription counts as a SIM swap because the number may have been used by someone else earlier, which makes it a direct recycling signal. Operators may limit the window for privacy reasons.
Number verification: the CAMARA Number Verification API confirms that a device on the mobile data network holds the SIM for a claimed number, which is stronger than an SMS code for proving possession at that moment, though it still says nothing about who the person is.
The US Reassigned Numbers Database: the FCC-mandated database answers yes, no or no data to whether a number has been permanently disconnected since a date you supply, using monthly reports from carriers under 47 CFR 64.1200(l). It was built for robocall consent and gives callers a safe harbour under 64.1200(m), but the same question (has this number changed hands since our customer gave it to us?) is useful before sending a reset code. It covers North American Numbering Plan numbers only.

Decision guidance

Situation	Recommended approach	Trade-off
Workforce accounts	Remove SMS and voice as MFA and recovery; use passkeys, security keys or authenticator apps with help desk recovery	Needs a supported recovery process for lost devices
High-value consumer accounts (banking, health, crypto)	SMS only as a fallback, never alone for recovery; SIM change check before any code; step-up after number change or dormancy	Telecom API costs and coverage gaps by country
Low-risk consumer accounts	SMS acceptable as one factor; prompt annual number confirmation; email plus number for recovery	Some friction for users who rarely log in
Phone-number-as-username apps	Bind accounts to a device credential at sign-up; on a new device with an old number, require the old device, a PIN or a recovery code before restoring data	Users who lose both device and PIN need a slower recovery route
Small organisations	Turn off SMS recovery for admins first; enforce app or key MFA in the identity provider	Limited budget for telecom signals, so rely on factor choice

How to implement: a phased approach

Inventory: list every flow that sends a code to, calls, or looks up by a phone number (sign-up, login, MFA, recovery, help desk, alerts, fraud linking). Note which accept the number alone.
Measure exposure: count accounts where SMS is the only second factor, accounts where SMS can both reset and authenticate, and numbers not verified in the last year.
Close the worst path first: stop SMS-only recovery for administrators and privileged staff, then for customers with stored payment or health data.
Add signals in report-only mode: call SIM change or reassigned-number checks before SMS resets, log the result, and do not block yet. Review for four to six weeks to see how often a change is legitimate.
Enforce step-up: when a change is recent or the account is dormant, require a second route (email code, authenticator, recovery code or manual review). Keep a feature flag so you can roll back to report-only if false positives overwhelm support.
Run hygiene campaigns: prompt users to confirm or update numbers, offer passkey or app enrolment in the same flow, and remove numbers that fail delivery or confirmation.
Update support scripts: agents should never treat "a code to the number on file" as sufficient for recovery, and should log every number change as a security event.

Detection and measurement

Events to log: phone number added, changed or removed; SMS reset requested and completed; SIM change or reassignment check results; SMS delivery failures; first login after long dormancy.
Patterns to alert on: SMS reset on a dormant account followed by a new device and profile change; reset from a number whose check reports a recent subscription change; many resets across accounts from numbers newly assigned at the same carrier.

Metrics that show the programme is working:

Share of active accounts where SMS is the only recovery method (aim to drive down).
Share of stored numbers verified in the last 12 months.
Number of SMS resets stepped up because of a recent SIM or subscription change, and how many of those were later confirmed as legitimate.
Account takeover cases where the root cause was a stale or reassigned number.
Support complaints from new number holders receiving another person's messages (a direct measure of stale data).

Common failure patterns

Assuming carrier protections cover it: port-out PINs and SIM locks protect the current subscriber. A former subscriber's number has left their account and nothing on the carrier side warns you.
Silent number changes: letting users change the stored number with only a code sent to the new number, which lets whoever holds any line rebind the account.
SMS-only alerts: security notifications that go only by text reach the new holder, so the real owner learns nothing until the account is lost.
Merging by number: fraud and marketing systems that link accounts by phone number join an old customer's history to a new stranger, sometimes exposing personal data.
Leaving leaver phones registered: returned company mobiles are reissued or recycled, while the number remains an MFA method for the departed employee's account.
Help desk shortcuts: agents verifying callers by "the number on file" or a texted code, which lets anyone holding the line pass as the customer. See the Vishing and Help Desk Social Engineering Awareness Guide.

Advice for individuals changing numbers

Change the number on bank, email, social media, health and government accounts before cancelling the old line, and remove it as a recovery method. If that cannot be done quickly, the Princeton researchers suggest parking the number on a low-cost plan or VoIP service. Move to passkeys or an authenticator app with stored recovery codes (see the MFA backup codes and recovery codes guide). If you are given a recycled number, ignore codes meant for someone else and never pay anyone who offers to "release" accounts tied to it.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-63B-4	Sec. 3.1.3.3 Authentication using the PSTN; Sec. 3.2.9 Restricted authenticators; Sec. 4.2 Account recovery; Sec. 4.6 Account notifications	Restricted status of SMS and voice, risk indicators, alternatives, recovery and notification routes
NIST SP 800-53 Rev. 5	IA-4 Identifier Management; IA-5 Authenticator Management; IA-2 Identification and Authentication (Organizational Users); AC-2 Account Management	IA-4 asks organisations to define a period for preventing identifier reuse, which telephone numbers do not respect; IA-5 covers authenticator binding and change
NIST CSF 2.0	PR.AA-01; PR.AA-02; PR.AA-03; DE.CM-03	Managing identities and credentials, binding them to people, authenticating and monitoring account activity
OWASP ASVS 5.0	V6.6.1	Conditions for offering PSTN one-time codes
MITRE ATT&CK	T1111 Multi-Factor Authentication Interception; T1078 Valid Accounts; T1586 Compromise Accounts; Mobile T1451 SIM Card Swap	Techniques that a stale or reassigned number makes easier

Practitioner checklist

Inventory every flow that uses a phone number as identifier, factor, recovery route or notification address.
Remove configurations where SMS can both reset a password and satisfy the second factor.
Remove SMS and voice MFA for workforce administrators and privileged users.
Store a verified-at date for each number and re-verify stale numbers through another channel.
Require an existing authenticator to change a stored phone number, and notify every other address on file.
Check for a recent SIM or subscription change before sending a reset code, starting in report-only mode.
Step up dormant accounts whose first action is an SMS reset.
Delete leaver mobile numbers from MFA registrations during offboarding.
Stop linking or merging customer records by phone number alone.

Standards and references

Related NHI Mgmt Group resources: SIM Swap Fraud Guide · Account Takeover Prevention Guide · Customer IAM (CIAM) Guide · OTP security

Phone Number Recycling Guide: Reassigned Numbers, Account Takeover and Why a Number Is a Weak Identifier