Every year, millions of phone numbers get reassigned to strangers, and the accounts tied to them often stay behind. If you’re switching numbers or carriers, a short audit now can save you from handing someone the keys to your email, bank, and messaging apps.
Why should you audit it?
Recycled numbers turn forgotten logins into open doors
A phone number feels like a personal possession, but treat it as a reusable resource. When you cancel a line or let a prepaid plan lapse, the number goes through an aging period and then returns to the pool.
In the United States, FCC rules require at least 45 days before a disconnected number can be reassigned, and residential numbers can be held for no more than 90 days. Industry estimates citing the FCC put the number of recycled lines at roughly 35 million a year. Rules and timelines elsewhere vary considerably. But after the deadline passes, the phone number becomes assignable once again, and chances are it’ll get reassigned relatively quickly. This is also why when you get a new number, you might still get phone calls and text messages meant for someone else for months, if not years. The number is yours, but for years before that, it belonged to someone else.
The problem is that websites and apps don’t know your number changed hands, and unless you do that manually, they will never know. Whatever you linked to it years ago stays linked: password resets, two-factor prompts, account recovery options, even the login itself on messaging apps that use your number as your identity. Whoever receives the number next can start a reset, and the text arrives on their phone.
Researchers at Princeton University measured how bad this gets. They examined 259 numbers available to new subscribers at two major US carriers and found that 171 of them, about 66 percent, were still tied to a previous owner’s accounts on popular websites. A hundred of the 259 were also linked to leaked login credentials online, which means an attacker could already hold the password and only need the text message to get in. The team also showed that attackers could use carrier lookup tools to find recycled numbers, buy one, and then reach the previous owner’s accounts.
Not every case involves a criminal. Sometimes a new owner simply starts receiving your appointment reminders or account alerts. That is still a privacy leak, and it can escalate. The uncomfortable part is that you usually won’t know it happened. There’s no notification when a stranger gets a code meant for you, which makes the audit a preventive job you have to do before the number leaves your hands.
How to (properly) audit it
Work through every account that could send a code
First of all, don’t throw away your old number yet. Keep both the new and old numbers active as you switch, since you might still need to receive the occasional text message.
Start by building a list, because the accounts you remember are rarely the whole picture. Search your email inbox for phrases like verification code, confirm your phone number, and security alert, and scan your password manager for entries you haven’t touched in years. Your carrier account, Apple or Google account, and primary email come first, since they can be used to recover almost everything else. Banks, payment services like PayPal, cloud storage, shopping accounts, social networks, and crypto exchanges follow.
Then open the security settings of each account and look in three places: the recovery phone number, the two-factor authentication method, and any setting that allows sign-in or password reset by text message. Replace the old number with your new one or, better, with something that doesn’t depend on a phone number at all, such as an authenticator app, a passkey, or a hardware security key. Where a service only offers SMS, use the new number and note it as a weak link to revisit.
Messaging apps deserve separate attention because they use the number as your identity. WhatsApp, Telegram, and Signal all tie your account to it, so check each app’s settings for a change-number option and use it before you give up the old line, rather than reinstalling later. Also check the quieter places: pharmacy and healthcare portals, airline and hotel loyalty programs, delivery apps with saved cards, and utility accounts.
Order matters. Do this while the old number still works, because you may need a text to approve each change. Save backup codes when a service offers them, and confirm the change by signing out and back in. Finally, look for the accounts you no longer use. Deleting a dormant account is safer than updating it, since an abandoned login with an old number attached is exactly what an attacker hopes to find.
Next steps
Park the number, harden your logins, and keep watching
Once the audit is done, decide what happens to the old number. If you can afford it, keep the line active for a while, or move it to a low-cost plan or a voice-over-IP service that accepts ported numbers. Princeton researchers suggested low-cost number parking as an option, alongside unlinking accounts first. Check the fees and porting rules first, since they differ by carrier and provider.
If the number is already gone, or sitting in its aging window, contact your previous carrier and ask whether it can be reactivated. Some carriers allow that for a limited time, although policies vary and the answer may be no. Speed matters here, because the window closes once the number is reassigned. In that case, work backward through the same list using each service’s account recovery flow, and prioritize email, banking, and anything that holds money.
Whatever you do with the number, reduce your dependence on SMS from here on. Move important accounts to an authenticator app, passkeys, or a hardware key, and store backup codes somewhere offline. Protect your carrier account too: set an account PIN or a number lock, if your carrier offers one, to make port-out attempts harder.
Then keep watching. For the next few months, pay attention to password reset emails you didn’t request, login alerts from unfamiliar locations, and messages from services about changed phone numbers. These can be early signs that someone has the old number and is testing it. If you see one, change the password, sign out of all other sessions, and contact the service. If financial accounts are involved, notify the bank and consider a credit freeze. Set a reminder for 90 days out to repeat a shorter version of the audit, since forgotten accounts tend to resurface as you use the internet.
Unlink your old number before someone else inherits it
Carriers reuse numbers, but websites keep trusting them. Before you give up a line, find every account that still trusts it, replace it with stronger sign-in methods, and consider parking the number. A short audit today is far cheaper than recovering a hijacked account later.
