Number Recycling Fraud
Fraud that exploits the practice of reassigning disconnected phone numbers to new subscribers, allowing the new holder to receive calls, texts, and account-reset codes intended for the previous owner.
Also known as: recycled number account takeover, number reassignment fraud, phone number reassignment risk
Last reviewed: 10 June 2026
When a mobile number is disconnected — because the customer stopped paying, switched carriers, or died — carriers typically hold the number for a period before reassigning it to a new subscriber. Account recovery systems at banks, social networks, email providers, and cryptocurrency exchanges often use the phone number linked to an account as a reset credential. If the original customer's accounts still have the old number set as a recovery option, the new subscriber who receives that number can trigger password-reset flows and gain access to accounts belonging to the previous holder.
Researchers have demonstrated that recycled numbers frequently still have active account associations at major online services. The fraud does not require any technical sophistication: the new subscriber simply requests a password reset on a service, receives the SMS, and gains access. Victims may not discover the compromise for months.
To protect yourself, remove your phone number as the sole recovery method for important accounts before porting away from a carrier or letting a number lapse. Use an email address or authenticator app as backup. If you acquire a new number, be aware that incoming messages may be intended for the previous holder and do not use them to access accounts.