Recycled numbers: the account recovery collision nobody owns
There is a category error at the base of consumer identity. Carriers lease numbers. Relying parties store them as identity. Nobody reconciles the two, and the reconciliation event — reassignment — is invisible to everyone except the person who inherits someone else's password resets.
What happens when a phone number is recycled?
Two people share a recovery identifier across time, and nobody owns the collision. Carriers reassign numbers after a disconnection period; relying parties treat the number as a durable identifier. The new holder can receive recovery codes for the previous holder's accounts.
- Reassignment is continuous and silent. The relying party learns nothing, and the notification channel for the change is the very number being changed.
- Identifiers differ on three properties that determine whether they can anchor recovery: lease term, transferability, and whether a freshness signal exists.
- A device-bound credential is the only commonly available consumer identifier with an indefinite term, no transferability and an intrinsic freshness signal.
Part of Telecom and subscriber identity
The two views of a telephone number
From the carrier's side, a number is inventory. It is assigned to a subscriber, returned when service ends, aged for a period, and reassigned. That lifecycle is normal, necessary, and governed by numbering resource rules.
From a relying party's side, a number is an attribute of a person that happens to also be a delivery channel. It is stored at signup and treated as stable for the life of the account, which may be a decade.
Neither view is wrong. They are simply incompatible, and nothing in the ecosystem forces them to be reconciled.
What actually happens at reassignment
A subscriber cancels. After an ageing period the number returns to inventory and is issued to someone new. The new subscriber begins receiving messages intended for the previous holder — delivery notifications, appointment reminders, and, consequentially, one-time passcodes and password reset links.
They did nothing wrong. They have been handed a set of capabilities over accounts belonging to a stranger, and in most cases they discover this passively over weeks.
The Identifier Durability Model
Three properties determine whether an identifier can serve as a recovery anchor. Score every identifier your service uses.
| Identifier | Lease term | Transferable? | Freshness signal available? |
|---|---|---|---|
| Telephone number | Months to years; carrier-controlled | Yes — by reassignment or port | Partial — reassignment databases, commercially gated |
| Email address | Indefinite for personal; employer-controlled for work | Yes — employer reissue, provider recycling | No |
| Government ID number | Lifetime | No | n/a |
| Device-bound credential | Until the key is deleted | No — private key non-exportable | Yes — assertion fails if the key is gone |
| Username | Indefinite | Yes — account transfer | No |
Only one row has a lease term the relying party controls, no transferability, and an intrinsic freshness signal. That is not an argument that everyone should immediately eliminate SMS; it is an argument about which identifier should be the anchor and which should be a convenience.
Why reassignment databases only partially help
Reassignment data exists and is consumable, and using it is materially better than not. Three limits are worth understanding before relying on it:
- It reduces rather than eliminates the window between reassignment and the relying party learning of it.
- Coverage and latency vary, and access is commercial, which means small relying parties frequently do not consume it at all.
- It tells you a number changed hands. It does not tell you which of your accounts should now be treated as unrecoverable, which is a policy decision you still have to make.
The migration nobody wants to run
Moving recovery off a phone number is unpopular internally because it degrades a working flow for a risk that manifests rarely and diffusely. The honest framing for that conversation:
- Count accounts whose sole recovery factor is a phone number. This is usually the majority and usually a surprise.
- Multiply by your annual reassignment exposure, estimated from account age distribution and typical carrier ageing periods.
- Add support cost per recovery dispute, which you can measure.
- Compare against the cost of prompting for a second factor at the next natural touchpoint.
The prompt is the cheap intervention. You do not need a migration programme; you need every existing account to be offered a durable anchor at its next login, and a policy that new accounts cannot be created with a phone number as the only recovery path.
A note on the person who inherits the number
They are the party with the least agency and the most exposure. They receive another person's account access unbidden, and in some jurisdictions acting on it — even accidentally — carries legal risk for them.
Any design that treats them as an adversary has misread the situation. They are a second victim of a structural mismatch between how numbers are leased and how identity is stored.
Why nobody owns this
| Party | Position | Consequence |
|---|---|---|
| Carrier | Reissuing numbers is necessary and lawful | No obligation to tell relying parties |
| Relying party | The number was verified when collected | No signal that it changed hands |
| Previous holder | Moved on | Accounts still reference it |
| New holder | Did nothing wrong | Receives someone else's recovery |
Objections and honest limits
“We re-verify numbers periodically.” Which helps if the re-verification detects a change of holder rather than merely that the number still answers. A new holder answers perfectly.
“Recycling databases solve this.” They help materially and are worth using. They are a signal about reassignment, not proof that the person behind the number is the one who enrolled.
Reducing identifier-recycling exposure
- Stop treating the number as an identity. It is a delivery channel with a changing holder.
- Bind recovery to a credential, not a channel. Something enrolled to the person, not assigned to them.
- Check reassignment signals before sending recovery. They are cheap and materially reduce the window.
- Re-affirm dormant accounts. Dormancy plus a recycled number is the specific combination that fails.
Terms used here
- Number recycling
- Reassigning a disconnected number to a new subscriber after a quarantine period.
- Recovery identifier
- A contact channel used to restore account access. Durable in the relying party's model and not in reality.
- Dormancy
- A period of account inactivity, during which contact details silently go stale.
Frequently asked questions
How long is a number aged before reassignment? It varies by carrier and by jurisdiction, and published practice differs. Plan for the shorter end of the range rather than the longer.
Is email a safer anchor? Personal email has a longer effective lease but is still transferable, and work email is controlled by an employer who may reissue it. Both are better than a phone number and neither is durable in the sense required.
What should a small service do? Consume reassignment data if you can afford it; require a second recovery factor if you cannot. The second option costs less and works better.
Does this apply to number porting as well? Porting moves a number between carriers for the same subscriber, so the identity binding is preserved. Reassignment breaks it. They are different events with different consequences.
Whose problem is number recycling? Structurally nobody's. The carrier acts lawfully, the relying party verified the number when collected, and the new holder did nothing wrong.
Do recycling databases fix it? They materially reduce the window and are worth using. They signal reassignment; they do not prove who holds the number.
What is the durable fix? Binding recovery to a credential enrolled to the person rather than to a channel assigned to them.
Where this fits in Manav
Manav puts the authorising party back in the loop for the changes that matter, with a signature bound to the specific change and verifiable by a counterparty without calling you.
Sources and further reading
- FCC rules and regulations
- Published academic research on recycled telephone number security.
- Carrier number ageing and reassignment practice documentation.
- NIST SP 800-63B — Authentication and authenticator management
- GSMA — fraud and security resources