Phone number recycling investigation

I nearly hacked into a stranger’s Facebook account. It’s something a scams and data privacy journalist like me warns people about – and would never do themselves (not without informed consent). But it happened by accident.

It started when I tried to reset my Facebook password after I’d forgotten it. I entered my mobile number and two profiles appeared on screen – one mine, the other belonging to a stranger.

The previous owner of the phone hadn’t updated her Facebook account, which meant I could have clicked on her profile image and a password reset code would have been sent to my (previously her) number. 

It’s likely I could have gained access to her Facebook profile – but of course, I didn't attempt this.

Instead, I messaged her to warn her, and began to investigate how something like this could possibly happen.

Get tech confident for less

Get 12 months of tech support and buying advice for only £34.30, that's a 30% saving. Together we’ll show your tech who’s boss.

Join Which? Tech Support

Offer ends 16 Jun 25. Cancel anytime.

A version of this article was originally published in Which? Tech magazine. Find out more about subscribing to Which? Tech, which includes unlimited 1-2-1 Tech support to help you get the most out of your tech and use it with confidence.

How phone number recycling works

If numbers weren’t reused when discarded by their users, they would eventually run out. It could happen sooner than you think, because some providers preassign numbers to Sim card packs on sale in shops, and not all of these end up being used.

The industry needs a way of clawing back numbers, because telecoms regulator Ofcom requires providers ‘to use numbers effectively and efficiently’.

Numbers can end up back in the pool in various ways. A customer might abandon theirs by cancelling their contract and/or switching to a new provider (without porting). 

In other cases, numbers are deactivated by the provider after a period of non-use by the customer, which can be as brief as 70 days, depending on the provider’s policy. 

In one way or another, many numbers are recycled. Both Lebara and Lyca Mobile told us that most of their numbers are reused. 

The problem is, there’s an array of potentially serious consequences from doing this, and Which? Tech has found few safeguards in place for them.

What's the risk?

This isn’t the niche issue it may first appear. For example, if you've ever changed your number, you could be affected. Here are some of the risks we've identified:

• Security risk: Your online accounts and identity are in danger if you change your number and don’t update it with relevant accounts and organisations.
• Child safety: Youngsters receiving their first phones could receive a recycled number and be exposed to inappropriate contact from strangers known to its previous owner.
• Cut off: Those who keep phones for occasional/emergency use risk being cut off after as little as 70 days of non-use so their number can be recycled. This is a particular concern for older people and victim-survivors of domestic abuse.
• Nuisance calls: You may be plagued with calls and messages meant for a previous owner of your number – and this can go on for years.

Nuisance calls

When you’re allocated a new number by a provider, you have no idea what it’s been used for previously, by whom or how recently. 

Problems can arise if people continue to try and reach the number’s previous owner or if they’ve been engaged in illegal activity.

Scott McGready, director of cybersecurity firm Damn Good Security, says there have been several recent cases of people who have acquired a new number and logged into WhatsApp with it, only to find the account is ‘already registered and being used to coordinate spam/scams.’ He added that the app is now starting to address the issue.

Several Which? members have told us of receiving calls and messages – in one case, for several years – that were clearly intended for their number’s previous owner. In two cases, the unwanted contact came from debt collection agencies, raising the prospect that people experiencing problem debt have changed their numbers to evade creditors.

If the contact comes from the same number each time, you can block the caller on your phone. The option is often available to view in your call log. 

However, blocked callers may still be able to leave a voicemail message, as these services are normally hosted by your mobile network. If this happens, contact your provider.

If the problem persists, your provider may offer to change your number as a last resort, but there’s no guarantee the replacement number will be clean, either. 

In more serious cases, where you are experiencing ongoing harassment, you can call the police on 101 (if you are in immediate danger, call 999).

Check out our advice on how to stop nuisance calls

Children's first phones

If your child receives a recycled number then it’s likely already known to a group of strangers who may not know it’s changed hands.

As Sarah’s story (see above) highlights, children could receive calls they’re not emotionally equipped to deal with, which have the potential to frighten or harm them.

Every year, more children come of age and receive their first phone, with Ofcom data showing that for most UK children this happens between the relatively tender ages of nine and 11. 

Parents and caregivers should discuss with their child the possibility of unwanted contact, and how to get help if they feel unsafe. 

The NSPCC has produced the TRUST toolkit (hosted on the Vodafone website) for young people receiving their first phone and their families, aimed at prompting conversations around safe use.

Security risk

Your accounts and online identity are in danger if you don’t update the phone number you have registered with accounts and organisations – especially if it's used for two-factor authentication (2FA - you can find out more about what 2FA is).

Many of us now use our mobile numbers as an extra layer of security, opting to have a single-use code texted to us in order to log in or reset our passwords. 

Damn Good Security's Scott McGready warns: ‘We’ve managed to convince people to use mobile numbers for their security, but failed to remind them when they cycle a number back into the system it could be the one key a malicious actor (or innocent person) could use to break into their entire life. And that is terrifying.’

It’s not just accounts with 2FA that you need to worry about, so think broadly when updating. Would you want someone receiving sensitive texts from your child’s school or your GP surgery?

Protect your data – we reveal the best antivirus

How many people don't update their number?

We surveyed more than 15,000 Which? members to find out the scale of the risk:

• One in 10 said they had changed their mobile within the past decade. Reasons cited for this included moving countries, disconnecting from abusive ex-partners, relinquishing a work phone after changing jobs, being the victim of a scam or simply buying a new phone.
• Of those who’d changed their phone number, only half said they’d updated their number with all relevant accounts and organisations. A quarter had only updated some (but not all) of their accounts, while one in 10 admitted they hadn’t updated anything.
• A third of members told us they didn’t know that phone companies can reallocate landline and mobile phone numbers which are no longer in use.
• Worryingly, 7% had experienced problems caused by the deactivation or reallocation of a landline and/or mobile phone number. The problems included nuisance calls and texts meant for previous owners and being deactivated without consent after a period of non-use.
• One respondent said they'd received 'many calls and text messages on [their] new UK phone number from people looking to buy drugs in Loughborough’. Another told us: ‘I sometimes receive texts offering illegal drugs for sale.’ 

Risk of being cut off

Many of us use our mobile phones every day, making it extremely unlikely we'd ever be deactivated for low usage.

To a frequent user, the shortest possible timescale for losing your number (70 days of non-use, according to Ofcom) might look reasonable at first glance.

But not everyone uses mobile phones in this way – some instead keep them for emergencies. For example, people enduring domestic abuse may keep a ‘safe phone’ that the abuser doesn't know about.

If the phone is only used occasionally, it raises the dreadful prospect of the victim-survivor retrieving the phone to reach help or arrange to flee, only to discover they’ve been cut off. 

We're worried about the impact of these little-known policies on more vulnerable groups. 

Older people’s charity Age UK shares our concern, with director Caroline Abrahams telling us: ‘Telecoms companies must recognise that people use mobile phones in different ways, and that for many older people it can be an emergency lifeline rather than something used every day. 

'They should take steps to ensure that nobody ever gets disconnected when they may well need the phone again, even if they’re not sure when that may be.’

News, deals and stuff the manuals don't tell you. Sign up for our free monthly Tech newsletter

How long do phone companies give you?

We sent a list of questions to the 16 UK mobile providers who feature in our annual customer satisfaction survey. 

We asked about policies and timescales for deactivation/reallocation, customer warnings and policies to prevent vulnerable people from being cut off.

Only 12 of the 16 answered some or all of our questions, making it difficult to compare policies across the industry:

• Among the 12 respondents, 'low usage' deactivation policies varied enormously, ranging from three months (Lebara and 1p Mobile) to nine months (Voxi). It was sometimes possible to reactivate the number if deactivation only occurred recently.
• Customers generally needed to make a call, send a text, use data or add credit within that timeframe to avoid being cut off. 
• Those on contracts were less vulnerable to being cut off than pay-as-you-go (PAYG) customers as their monthly payments generally counted as a form of usage.
• Several networks told us they either don’t warn customers they’re about to be disconnected (Tesco Mobile), or warn them by texting the very numbers that aren’t in regular use (EE, Lyca Mobile, Vodafone and Voxi).
• Vodafone and EE told us PAYG customers who get disconnected will lose any credit on their account – something Which? members have told us also happens with other providers.
• Giffgaff shared that it holds on to deactivated numbers for a year before reallocating them to another customer, while Three waits at least 18 months.

What does the regulator say?

We shared our findings and concerns with Ofcom, and asked whether it planned to develop clearer guidance for firms. It told us: 

‘We expect mobile operators to have clear policies about when a phone number will be recycled, and give customers fair warning before their number is switched off. This can happen if a PAYG customer doesn’t use their phone very often, because phone numbers are a finite resource, and we have a duty to make sure they are managed effectively. 

'We know it can be frustrating, and we’d advise customers to check their provider’s terms and conditions so they know how often they should use their phone to keep it active.’

What can you do?

If you’re changing provider to seek better customer service or a money-saving deal, you can easily keep your existing number and move it over to your new provider. This is known as ‘porting’. 

To do this, you’ll need a unique number called a Port Authorisation Code (PAC), which you can request by texting ‘PAC’ to 65075. Your PAC will be texted back to you within two working days.

Once you have a PAC, it’s valid for 30 days. If it expires, you can request a new one. Give the PAC to your new provider and it will notify your current provider of the port request. Your number is normally ready to use with your new services within one working day.

If you're not on a contract and you don't use your phone regularly, read your provider's T&Cs or contact it to find out what you have to do to keep your service active.

Compare mobile providers to find the best deal

Names of case studies have been changed.