{
 "slug": "identifier-durability-model",
 "topic_id": "TOPIC-154",
 "cluster": "Telecom Carrier & Subscriber Identity",
 "tier": "Tier B",
 "title": "Recycled numbers: the account recovery collision nobody owns",
 "summary": "A phone number is treated as a durable identifier by thousands of relying parties and as a leased resource by carriers. When a number is reassigned, every account still bound to it becomes reachable by a stranger.",
 "lede": "There is a category error at the base of consumer identity. Carriers lease numbers. Relying parties store them as identity. Nobody reconciles the two, and the reconciliation event — reassignment — is invisible to everyone except the person who inherits someone else's password resets.",
 "date": "2023-12-08",
 "category": "Vertical",
 "author_id": "constance-ibe-whitmore",
 "tags": [
  "number reassignment",
  "recycled numbers",
  "account recovery",
  "SMS OTP",
  "identifier lifecycle",
  "consumer identity"
 ],
 "image_title": "Identifier Durability Model",
 "schema": "Article",
 "key_takeaways": [
  "Reassignment is continuous and silent. The relying party learns nothing, and the notification channel for the change is the very number being changed.",
  "Identifiers differ on three properties that determine whether they can anchor recovery: lease term, transferability, and whether a freshness signal exists.",
  "A device-bound credential is the only commonly available consumer identifier with an indefinite term, no transferability and an intrinsic freshness signal."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The two views of a telephone number"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "One number, two people, no coordination",
   "caption": "Each party behaves correctly. The gap exists between them.",
   "nodes": [
    {
     "label": "Subscriber disconnects",
     "sub": "stops paying",
     "note": "ordinary"
    },
    {
     "label": "Number quarantined, then reissued",
     "sub": "carrier policy",
     "note": "lawful"
    },
    {
     "label": "Relying parties still hold it",
     "sub": "as a recovery factor",
     "note": "stale",
     "bad": true
    },
    {
     "label": "New holder receives codes",
     "sub": "for someone else's accounts",
     "note": "",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "From the carrier's side, a number is inventory. It is assigned to a subscriber, returned when service ends, aged for a period, and reassigned. That lifecycle is normal, necessary, and governed by numbering resource rules."
  },
  {
   "type": "p",
   "html": "From a relying party's side, a number is an attribute of a person that happens to also be a delivery channel. It is stored at signup and treated as stable for the life of the account, which may be a decade."
  },
  {
   "type": "p",
   "html": "Neither view is wrong. They are simply incompatible, and nothing in the ecosystem forces them to be reconciled."
  },
  {
   "type": "h2",
   "text": "What actually happens at reassignment"
  },
  {
   "type": "p",
   "html": "A subscriber cancels. After an ageing period the number returns to inventory and is issued to someone new. The new subscriber begins receiving messages intended for the previous holder — delivery notifications, appointment reminders, and, consequentially, one-time passcodes and password reset links."
  },
  {
   "type": "p",
   "html": "They did nothing wrong. They have been handed a set of capabilities over accounts belonging to a stranger, and in most cases they discover this passively over weeks."
  },
  {
   "type": "h2",
   "text": "The Identifier Durability Model"
  },
  {
   "type": "p",
   "html": "Three properties determine whether an identifier can serve as a recovery anchor. Score every identifier your service uses."
  },
  {
   "type": "table",
   "head": [
    "Identifier",
    "Lease term",
    "Transferable?",
    "Freshness signal available?"
   ],
   "rows": [
    [
     "Telephone number",
     "Months to years; carrier-controlled",
     "Yes — by reassignment or port",
     "Partial — reassignment databases, commercially gated"
    ],
    [
     "Email address",
     "Indefinite for personal; employer-controlled for work",
     "Yes — employer reissue, provider recycling",
     "No"
    ],
    [
     "Government ID number",
     "Lifetime",
     "No",
     "n/a"
    ],
    [
     "Device-bound credential",
     "Until the key is deleted",
     "No — private key non-exportable",
     "Yes — assertion fails if the key is gone"
    ],
    [
     "Username",
     "Indefinite",
     "Yes — account transfer",
     "No"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Only one row has a lease term the relying party controls, no transferability, and an intrinsic freshness signal. That is not an argument that everyone should immediately eliminate SMS; it is an argument about which identifier should be the anchor and which should be a convenience."
  },
  {
   "type": "h2",
   "text": "Why reassignment databases only partially help"
  },
  {
   "type": "p",
   "html": "Reassignment data exists and is consumable, and using it is materially better than not. Three limits are worth understanding before relying on it:"
  },
  {
   "type": "ul",
   "items": [
    "It reduces rather than eliminates the window between reassignment and the relying party learning of it.",
    "Coverage and latency vary, and access is commercial, which means small relying parties frequently do not consume it at all.",
    "It tells you a number changed hands. It does not tell you which of your accounts should now be treated as unrecoverable, which is a policy decision you still have to make."
   ]
  },
  {
   "type": "h2",
   "text": "The migration nobody wants to run"
  },
  {
   "type": "p",
   "html": "Moving recovery off a phone number is unpopular internally because it degrades a working flow for a risk that manifests rarely and diffusely. The honest framing for that conversation:"
  },
  {
   "type": "ol",
   "items": [
    "Count accounts whose sole recovery factor is a phone number. This is usually the majority and usually a surprise.",
    "Multiply by your annual reassignment exposure, estimated from account age distribution and typical carrier ageing periods.",
    "Add support cost per recovery dispute, which you can measure.",
    "Compare against the cost of prompting for a second factor at the next natural touchpoint."
   ]
  },
  {
   "type": "p",
   "html": "The prompt is the cheap intervention. You do not need a migration programme; you need every existing account to be offered a durable anchor at its next login, and a policy that new accounts cannot be created with a phone number as the only recovery path."
  },
  {
   "type": "h2",
   "text": "A note on the person who inherits the number"
  },
  {
   "type": "p",
   "html": "They are the party with the least agency and the most exposure. They receive another person's account access unbidden, and in some jurisdictions acting on it — even accidentally — carries legal risk for them."
  },
  {
   "type": "p",
   "html": "Any design that treats them as an adversary has misread the situation. They are a second victim of a structural mismatch between how numbers are leased and how identity is stored."
  },
  {
   "type": "h2",
   "text": "Why nobody owns this"
  },
  {
   "type": "table",
   "caption": "Each party's position",
   "head": [
    "Party",
    "Position",
    "Consequence"
   ],
   "rows": [
    [
     "Carrier",
     "Reissuing numbers is necessary and lawful",
     "No obligation to tell relying parties"
    ],
    [
     "Relying party",
     "The number was verified when collected",
     "No signal that it changed hands"
    ],
    [
     "Previous holder",
     "Moved on",
     "Accounts still reference it"
    ],
    [
     "<strong style=\"font-weight:600\">New holder</strong>",
     "<strong style=\"font-weight:600\">Did nothing wrong</strong>",
     "<strong style=\"font-weight:600\">Receives someone else's recovery</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“We re-verify numbers periodically.”</strong> Which helps if the re-verification detects a change of holder rather than merely that the number still answers. A new holder answers perfectly."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Recycling databases solve this.”</strong> They help materially and are worth using. They are a signal about reassignment, not proof that the person behind the number is the one who enrolled."
  }
 ],
 "faq": [
  {
   "q": "How long is a number aged before reassignment?",
   "a": "It varies by carrier and by jurisdiction, and published practice differs. Plan for the shorter end of the range rather than the longer."
  },
  {
   "q": "Is email a safer anchor?",
   "a": "Personal email has a longer effective lease but is still transferable, and work email is controlled by an employer who may reissue it. Both are better than a phone number and neither is durable in the sense required."
  },
  {
   "q": "What should a small service do?",
   "a": "Consume reassignment data if you can afford it; require a second recovery factor if you cannot. The second option costs less and works better."
  },
  {
   "q": "Does this apply to number porting as well?",
   "a": "Porting moves a number between carriers for the same subscriber, so the identity binding is preserved. Reassignment breaks it. They are different events with different consequences."
  },
  {
   "q": "Whose problem is number recycling?",
   "a": "Structurally nobody's. The carrier acts lawfully, the relying party verified the number when collected, and the new holder did nothing wrong."
  },
  {
   "q": "Do recycling databases fix it?",
   "a": "They materially reduce the window and are worth using. They signal reassignment; they do not prove who holds the number."
  },
  {
   "q": "What is the durable fix?",
   "a": "Binding recovery to a credential enrolled to the person rather than to a channel assigned to them."
  }
 ],
 "sources": [
  {
   "t": "FCC rules and regulations",
   "u": "https://www.fcc.gov/general/rules-regulations-title-47"
  },
  {
   "t": "Published academic research on recycled telephone number security."
  },
  {
   "t": "Carrier number ageing and reassignment practice documentation."
  },
  {
   "t": "NIST SP 800-63B — Authentication and authenticator management",
   "u": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
   "t": "GSMA — fraud and security resources",
   "u": "https://www.gsma.com/solutions-and-impact/technologies/security/"
  }
 ],
 "related": [
  {
   "slug": "line-change-authorization",
   "title": "The subscriber never signs",
   "category": "Vertical"
  },
  {
   "slug": "consumer-identity-budget",
   "title": "The consumer identity budget",
   "category": "Vertical"
  },
  {
   "slug": "consent-reaffirmation",
   "title": "Third-party OAuth consent",
   "category": "Developer"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Identifier%20Durability%20Model/1200_630/blog.jpg",
 "wordcount": 979,
 "url": "/blog/identifier-durability-model.html",
 "reading_time": "4 min read",
 "meta_description": "A phone number is treated as a durable identifier by thousands of relying parties and as a leased resource by carriers.",
 "hub": {
  "slug": "topics/telecom-identity",
  "title": "Telecom and subscriber identity"
 },
 "answer": "Two people share a recovery identifier across time, and nobody owns the collision. Carriers reassign numbers after a disconnection period; relying parties treat the number as a durable identifier. The new holder can receive recovery codes for the previous holder's accounts.",
 "answer_q": "What happens when a phone number is recycled?",
 "glossary": [
  {
   "term": "Number recycling",
   "def": "Reassigning a disconnected number to a new subscriber after a quarantine period."
  },
  {
   "term": "Recovery identifier",
   "def": "A contact channel used to restore account access. Durable in the relying party's model and not in reality."
  },
  {
   "term": "Dormancy",
   "def": "A period of account inactivity, during which contact details silently go stale."
  }
 ],
 "checklist": {
  "title": "Reducing identifier-recycling exposure",
  "id": "reduce",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Stop treating the number as an identity.",
    "text": "It is a delivery channel with a changing holder."
   },
   {
    "name": "Bind recovery to a credential, not a channel.",
    "text": "Something enrolled to the person, not assigned to them."
   },
   {
    "name": "Check reassignment signals before sending recovery.",
    "text": "They are cheap and materially reduce the window."
   },
   {
    "name": "Re-affirm dormant accounts.",
    "text": "Dormancy plus a recycled number is the specific combination that fails."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav puts the authorising party back in the loop for the changes that matter, with a signature bound to the specific change and verifiable by a counterparty without calling you.",
  "href": "../docs.html",
  "label": "See change authorisation"
 }
}