Do Mobile Phone Numbers Get Recycled? Risks, Fraud Implications & Prevention

The concept of mobile phone number recycling may seem strange but is essential. Mobile phone numbers aren’t endless, and the demand for them is constantly rising. But what happens when a number is recycled? And what are the potential security risks for businesses relying on phone numbers for customer identity verification?

The short answer: yes. When a mobile number is cancelled or left unused, the network takes it back and, after a holding period, gives it to a new customer. In the UK there is no fixed rule: Ofcom says the time before a number returns to the pool varies by operator, from three months to a year. In the US the FCC requires numbers to be held for at least 45 days, and in India the regulator TRAI says at least 90 days. Once a number is reassigned, it can still be linked to the previous owner’s accounts, messages and two-factor authentication codes.

What is mobile phone number recycling?

Mobile phone number recycling is the process of reassigning a previously used number to a new customer. When a number is deactivated by its original user, it doesn’t stay inactive forever. After a specified period, mobile network operators (MNOs) can repurpose it for a new user. This recycling process helps MNOs manage the limited pool of available phone numbers effectively, especially as the number of mobile users continues to grow.

What does it mean when a phone number is recycled?

When a phone number is recycled, it shifts identity from the previous owner to a new one. However, while the number itself is reassigned, remnants of the previous owner’s digital footprint can still be linked to it. That means the new owner may receive communications, notifications or even attempts to access services meant for the previous user. This phenomenon, where data linked to a phone number doesn’t immediately update with its new owner, presents potential risks in security and privacy, impacting businesses that rely on these numbers for customer verification and fraud prevention.

How does mobile phone number recycling work?

Every MNO has a unique approach to recycling, typically involving three stages:

• Deactivation: When a user stops using a mobile number (perhaps because they’ve switched providers without moving their number, or simply stopped topping up) the MNO deactivates the number after a certain period. This also applies when accounts remain dormant without payment. Pay as you go customers are the most affected, because a monthly bill usually counts as use on a contract.
• Dormancy period: Once deactivated, numbers are held for a set period, sometimes called quarantine, so the previous user can reclaim it. In the UK this varies by operator, from around three months to a year or more. This buffer is intended to minimise immediate reassignment but isn’t always enough to clear the number’s history fully.
• Reassignment: After the dormancy period, the number becomes eligible for reassignment. While MNOs may reset or erase data associated with the number, data remnants sometimes remain connected to online services, especially in systems relying on SMS-based two-factor authentication (2FA).

The phone number recycling process varies globally, with some countries operating shorter dormancy periods, which can further amplify the security risks associated with reassignment.

How long before a phone number is recycled?

There is no single answer, because each country, and in the UK each network, sets its own rules. These are the published timescales:

For businesses, the point is simple: a number in your customer database can belong to someone else within a few months of the original customer stopping using it.

What are the main issues with mobile phone number recycling?

• Privacy concerns: Recycled numbers can create privacy issues, as the new owner may receive messages, calls or notifications meant for the former owner. This can lead to unintended data exposure, affecting both individuals and businesses. In a 2024 Which? survey of more than 15,000 members, 7% had experienced problems from a number being deactivated or reallocated, including calls and texts meant for previous owners.
• Access to online accounts: Two things can happen. Firstly, the new owner might get access to information belonging to the old owner simply by entering the number. WhatsApp was a well-known example: a new owner could be logged straight into someone else’s account. It now treats a number as recycled when an account has been unused for 45 days and is then activated on a different device, and removes the old profile details. Secondly, new users may be prevented from creating an account at all, because their number is still associated with an old account that has not been updated. One number cannot be associated with two accounts on the same platform at the same time. Which? found only half of people who had changed number had updated all their accounts.
• Identity confusion: Businesses that rely on phone numbers for customer contact or verification may experience issues if a number has been reassigned. For example, in countries with strong privacy laws such as the UK and EU GDPR, organisations can draw complaints from data subjects by sending communications that, from the new owner’s perspective, are unsolicited.

Is mobile phone number recycling a fraud risk?

Yes, mobile phone number recycling is a genuine fraud risk, particularly for businesses reliant on phone numbers for secure user identification and verification. Here’s how:

• Increased potential for SIM swap attacks: There have been cases of people deliberately taking over a number that belonged to a target to commit fraud, but this has normally involved some kind of insider fraud where an employee of the operator is also involved. This may sound rare, but it is a growing problem for operators in several countries.
• Recycled numbers look risky: A number recycle is by definition a SIM swap, since the new owner will not have the same SIM card as the old owner. After this swap, the number is perceived to be more risky, which can affect the new owner’s ability to apply for new accounts and carry out transactions.
• Impact on businesses: From financial institutions to social media companies, businesses relying on phone numbers for verification risk exposing themselves to fraud if numbers are recycled. This can lead to customer dissatisfaction, a breakdown in trust, and even financial losses or failure to comply with industry legislation.

Research from Princeton University shows how real the risk is. Researchers Kevin Lee and Arvind Narayanan sampled 259 available numbers at two major US carriers and found 215 were recycled numbers open to at least one type of attack. 171 were still linked to accounts at sites including Amazon, Facebook, Google and PayPal, and of 200 recycled numbers they held for a week, 19 still received security or privacy-sensitive messages such as one-time passcodes.

Businesses need to stay aware of these risks, particularly as fraudsters exploit vulnerabilities related to phone number recycling.

Phone number recycling policies and practices

MNOs worldwide have varying recycling policies, affecting the timeline and approach to reassigning numbers:

• Variations by carrier: UK networks set their own timescales. Lebara and 1p Mobile deactivate low-usage numbers after three months, Giffgaff holds deactivated numbers for a year and Three waits at least 18 months before reallocating. Some networks, including EE, Vodafone and Voxi, text customers before deactivating a number; others don’t. These policies reduce issues with recycling, but they don’t eliminate the risks.
• International differences: Rules differ between countries: the US allows reassignment after 45 days, India after 90. Where dormancy periods are shorter, the likelihood of residual account access rises. This makes it essential for businesses operating globally to be vigilant in managing recycled numbers.
• Suggested best practices for carriers: Extended dormancy periods, stricter data-clearing protocols and alert systems that notify businesses and users about potential recycling issues could all help mitigate these risks. However, MNOs need to balance number availability with security concerns.

How businesses can reduce the risk

• Check the number before high-risk actions: before sending a one-time passcode for a password reset, a payment or a change of details, check that the number is still active and whether it has recently changed hands.
• Re-verify dormant customers: if a customer hasn’t used their number with you for several months, treat it as unverified until it is confirmed again.
• Don’t rely on SMS alone for account recovery: offer a second recovery route for high-value accounts.
• Clean your database regularly: flag or remove numbers that are inactive, unassigned or recently recycled before you run campaigns.
• In the US, check the FCC’s Reassigned Numbers Database before calling or texting consumers.

How TMT ID can help mitigate the risks of mobile phone number recycling

As a leader in mobile number intelligence, we offer solutions to help businesses manage the complexities and risks of recycled numbers.

1. Real-time mobile number intelligence: We provide businesses with real-time insights into the status of phone numbers, including identifying recycled numbers, detecting recent ownership changes and flagging associated risks. Our API can show whether a mobile number is active and how long ago it was last recycled. This proactive approach reduces the chances of misidentifying a customer based on an outdated phone number.
2. Enhanced verification services: With our verification API products, such as Verify, businesses can distinguish recycled numbers from active, single-owner numbers, ensuring more secure and reliable verification processes. This prevents unauthorised access and ensures companies can communicate securely with customers.
3. Fraud prevention: TMT ID’s data-driven intelligence helps mitigate fraud risks associated with recycled numbers by identifying when a number changes ownership. This information is vital for businesses aiming to protect customer accounts and maintain a secure digital environment. For whole databases, our data cleansing service finds inactive, unassigned and recycled numbers in bulk.

Frequently asked questions

How long does it take for a phone number to be recycled?

It depends on the country and the network. In the UK, Ofcom says numbers return to the pool anywhere from three months to a year after deactivation, and Three waits at least 18 months. In the US numbers must be held for at least 45 days, and in India at least 90 days.

Can I get my old number back after it has been recycled?

Usually not once it has been given to someone else. During the holding period, some networks can reactivate a recently deactivated number, so contact your provider as soon as possible. If you are switching provider in the UK, text PAC to 65075 to keep your number.

Can someone use my old number to get into my accounts?

Yes, if your accounts still use that number to log in or to receive security codes. Before you give up a number, update it on every account, especially those that use it for two-factor authentication.

How can a business tell if a number has been recycled?

Mobile number intelligence can check in real time whether a number is active and whether, and when, it last changed hands. Running that check before you rely on a number for verification or contact closes the gap that recycling creates. Talk to our team to see how it works.

The future of phone number recycling and security

As the demand for mobile numbers increases, the recycling of numbers is here to stay. However, the security risks associated with recycled numbers, from accidental data leaks to fraud vulnerabilities, are significant for businesses relying on phone numbers for customer verification. To stay ahead, companies must adopt intelligent mobile number verification solutions to protect themselves against the hidden risks of recycled numbers.

For businesses and individuals alike, the advice is clear: stay vigilant, update contact information promptly and use advanced verification methods whenever possible. In a world where digital identity is increasingly mobile-centric, awareness of phone recycling risks is essential for maintaining both privacy and security.

To learn more about how TMT ID can protect your business from the risks of recycled numbers, explore our mobile intelligence solutions or contact us for a consultation.