Security · 2026-04-09

Silent Number Recycling as a Carrier Signal

By J. W. Bouckaert

A verified number can change hands

A service that uses phone numbers for sign-in or account recovery assumes that the person who controls a number today is the person who controlled it when it was added to the account. Number recycling breaks that assumption. When a subscriber disconnects, the carrier holds the number for a period and then assigns it to a new subscriber. The services the old owner used are not told.

In the United States about 35 million numbers are disconnected each year, a figure from the FCC that the Princeton study below cites. This article covers how recycling works, what the research found, the tools that exist to check whether a number was reassigned, and what PasskeyBridge does with recycling signals.

The recycling process

A disconnected number goes through an aging period before it can be assigned again. In the US, 47 CFR 52.15(f)(1)(ii) sets the limits: numbers from residential customers are aged for no less than 45 and no more than 90 days, and numbers from business customers for 45 to 365 days. After aging, the number returns to the pool and can be given to a new customer.

The carrier does not contact banks, email providers or other services that have the number on file. The first sign of a reassignment can be a one-time passcode or password reset arriving on the new owner's phone.

The Princeton study

In 2021 Kevin Lee and Arvind Narayanan of Princeton published Security and Privacy Risks of Number Recycling at Mobile Carriers in the United States (APWG eCrime 2021). Their findings:

• They sampled 259 numbers available to new subscribers at two major US carriers.
• 171 of them (66%) were still linked to accounts at Amazon, AOL, Facebook, Google, PayPal or Yahoo, so a new owner could attempt SMS-based account recovery.
• 100 of the 259 (39%) were associated with email addresses and passwords found in data breaches, which could let an attacker bypass SMS-based two-factor authentication.
• Over one week, 19 of 200 numbers the researchers obtained were still receiving security- or privacy-sensitive messages meant for the previous owner.

Recycling and SIM swap

A SIM swap moves a number that is still in use onto an attacker's SIM, usually through social engineering or an insider. Recycling is a normal carrier process that gives a disconnected number to a new, usually innocent subscriber. The effect on an account is similar: codes and reset links reach someone other than the account holder.

Carrier SIM-swap and porting checks were designed for the first case. A recycled number is not ported, so a port check does not catch it. A SIM-change date can show that the number recently moved to a new SIM, but it does not show whether the subscriber changed.

Checking whether a number was reassigned

Two tools answer the question directly.

The FCC database of reassigned numbers

The FCC created the Reassigned Numbers Database in its 2018 order FCC 18-177 to reduce calls to numbers that have changed hands. Providers report permanent disconnections each month. A caller submits a number and a date, such as the date the customer gave the number, and receives "yes" if the number was permanently disconnected since then, "no" if it was not, or "no data". The database was built for callers that need consent under the Telephone Consumer Protection Act.

CAMARA Number Recycling API

The CAMARA project, which defines the network APIs carriers offer through GSMA Open Gateway, has a Number Recycling API in its Know Your Customer group. The caller sends a phone number and a date, and the carrier answers whether the number has been recycled since that date. Availability depends on the carrier and country.

Other checks

• Store the date each phone number was verified, so it can be passed to either check.
• Re-verify numbers that have not been used for a long time before relying on them for recovery.
• Offer passkeys or another authenticator that does not depend on the phone number.

Guidance from NIST

NIST SP 800-63B-4 (2025) treats one-time codes sent over the public telephone network as a restricted authenticator and says:

"Verifiers SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior) before using the PSTN to deliver an out-of-band authentication secret."

A reassignment check fits under "other abnormal behavior".

Recycled numbers at PasskeyBridge

PasskeyBridge does not send one-time passcodes. It supplies identity signals that a tenant uses before sending one, and stores phone numbers only as keyed HMAC-SHA-256 digests under a server-held pepper.

• A carrier lookup asks one provider per request for line type, porting and SIM-swap data, depending on what that provider reports.
• A tenant can send a number_recycle signal, for example after its own Reassigned Numbers Database or CAMARA check, through the same signal API.
• PasskeyBridge classes number_recycle as a soft signal. Hard signals such as sim_swap and port_out immediately revoke the affected AI agent delegations. A soft signal is recorded with the tenant's other signals but does not revoke delegations by itself.

PasskeyBridge does not query the Reassigned Numbers Database or the CAMARA Number Recycling API itself.

---

See the carrier signal landscape and the SIM swap detection overview.

Start free · Test the API