Silent number recycling

Silent number recycling is the reassignment of a dormant phone number to a new subscriber without any signal reaching the services that still associate the number with its previous owner. The new holder of the number can then receive password resets and one-time passcodes for accounts they never owned.

Recycling is the no-attacker version of a SIM swap: nothing was hacked, yet the binding between person and number silently broke. Services that treat a phone number as a stable identifier inherit this risk for every dormant account.

Regulators publish aging periods before a disconnected number can be reassigned, and some markets provide a way to check whether a number has been reassigned since a given date. Those mechanisms exist because the failure is a known systemic one rather than an edge case, and they are the only external signal a relying party gets that a binding it recorded years ago may no longer hold.

The exposure grows quietly with account age, which is what makes it different from an attack. Nobody is targeting the account; a dormant user stops paying a bill, the number returns to the pool, and months later a stranger receives a password reset for a service they have never heard of. No log on the defending side records the moment the binding broke.

The structural answer is to stop treating a phone number as an identifier and start treating it as a channel whose current binding is checkable. Re-verifying the binding at use time, rather than trusting an enrollment record, is the same correction that SIM tenure and number verification make for the attacker-driven cases.

The remedy that does not require carrier cooperation is to re-establish the binding on a schedule and on every sensitive action, and to treat a long silence from an account as a reason to re-verify rather than as evidence that nothing has changed. Dormancy is the precondition for this failure, so dormancy is the signal to act on.