Phone Number Recycling: Why a Number Can Belong to Someone Else Later

How Carriers Reissue Numbers

Numbering space is finite and regulated. In the United States, the FCC requires carriers to hold a disconnected number for a minimum aging period of 45 days before reassigning it, and permits up to 90 days for residential numbers and 365 for business ones. Most US carriers reissue within 60 to 90 days. In the United Kingdom, Ofcom guidance allows reuse after six months, though prepaid numbers on EE, Vodafone, O2, and Three lapse earlier if the SIM goes unused for 90 to 180 days with no top-up. Prepaid-heavy markets like India, Indonesia, the Philippines, and Nigeria recycle fastest: an unused Jio or Telkomsel SIM is typically deactivated after 60 to 90 days and the number reissued shortly after.

The FCC estimates around 35 million US numbers are disconnected and reassigned each year. In 2021 it launched the Reassigned Numbers Database, which lets businesses check whether a number has changed hands since a given date, chiefly so debt collectors and marketers do not call the wrong person. It exists because the problem is large enough to regulate, and it is only available to callers who pay for access, not to platforms verifying accounts.

From the platform's side, a reassigned number looks identical to the original. WhatsApp, Google, Facebook, and every bank see the same digits and have no signal that the person holding them changed. That gap is where the risk lives.

What Happens to Accounts Left on a Lapsed Number

If an account uses the phone number for login or recovery and the number is reissued, the new holder can request a code and receive it. For WhatsApp and Telegram, which log in by phone number alone, the new holder can register the number and take over the chat identity outright; WhatsApp's documentation acknowledges this and says inactive accounts are deleted after 45 days of no use partly for this reason. For Google, Facebook, Instagram, and most banks, the new holder can start a password reset that sends an SMS code, and if the account has no stronger recovery factor, they get in.

This is not theoretical. Researchers at Princeton published a study in 2021 in which they bought 200 recycled numbers from two US carriers and found that 171 of them were still linked to accounts on major websites, with 100 of them tied to accounts that leaked personal information via password-reset flows. Several came with pending two-factor codes for accounts the previous holder had not updated.

The risk applies equally to a carrier number you abandon and to a temp number you let expire. The difference is only the speed of the cycle.

How Shared Pool Numbers Cycle

A shared temp number, the kind listed on public receive-SMS pages, is never assigned to anyone. The number sits on a page, everyone who visits can read every message that arrives, and dozens or hundreds of people register accounts on it in a single day. The number does not cycle in the carrier sense; it is permanently in a state where it belongs to no one and everyone.

For accounts, that is the worst case. Any account verified on a shared number can have its password reset by any visitor who requests a code while the number is still listed. When the operator finally retires the number, usually because platforms have blocked it, the accounts on it become unreachable. There is no point at which the number was safely yours. The full comparison is at /blog/shared-vs-private-number.

How Private Rentals Cycle

A private TempNumber.me number is assigned to one user for the period they hold it. On an activation, that period is the verification window, typically 10 to 20 minutes, after which the number returns to the pool. On a rental, the number is held for the days you have paid for and receives every message sent to it, and you can extend it before the period ends. During the hold no other user can receive SMS on that number.

When the rental ends without extension, the number goes back to the pool and is later assigned to another user. Any account still using it for login or recovery is now reachable by whoever gets the number next, exactly as with a lapsed carrier number, only sooner. TempNumber.me cannot prevent this: once the rental has ended the number is no longer yours, and support cannot retrieve messages sent to it or reassign it back. The rental durations and what happens at the end are described at /blog/how-long-do-temp-numbers-last.

This is the honest trade. A private rental gives you a number that is yours and only yours for a defined period, without a SIM or a contract. What it does not give you is a number that is yours forever unless you keep paying for it.

Before the Number Expires: Two Options

Every account verified on a temp number should end up in one of two states before the number lapses. Either the number has been removed from the account and replaced with a recovery method you control, or the rental has been extended so the number stays yours.

• Remove the number. For accounts that only needed the phone at signup (Reddit, Discord, most marketplaces, Spotify), go to the account settings, add a verified email and, where offered, an authenticator app, then delete the phone number from the profile and recovery options. Once removed, the number's reassignment cannot affect the account.
• Replace the number. For accounts that require a phone on file (Google in some regions, Facebook, PayPal), swap the expiring number for a fresh rental or for a number you own before the old one lapses. Platforms usually send a code to the new number to confirm it, so do this while both are reachable.
• Extend the rental. For accounts where the phone is the identity (WhatsApp, Telegram, Signal, Viber) there is nothing to remove; the account is the number. Keep the rental active for as long as you want the account, and set a reminder before each renewal date.
• Accept the loss. For a throwaway signup you will never return to, let the number go. Do not leave a card, a wallet balance, or personal data on the account first.

Platforms Where Recycling Bites Hardest

WhatsApp and Telegram are the clearest cases because the number is the account. A lapsed rental on either means the next holder can register and appear as you to your contacts. Telegram lets you set a cloud password (two-step verification) that a new number holder must know, and enabling it is the single most effective protection on that platform. WhatsApp's two-step PIN does the same and should be set the day the account is created.

Google is the second case. Gmail accounts created with a phone number keep it as a recovery option, and Google's account-recovery flow will happily send a code to whoever holds it. Remove the phone under Security, Recovery Phone, once a recovery email and authenticator are in place. Banks and exchanges are the third case and the reason a temp activation should never be the second factor on an account with money in it; the reasoning is at /blog/sim-swap-protection.

The one-time code mechanism itself, and why platforms trust it as much as they do, is explained at /blog/sms-otp-explained. The short version is that an OTP proves control of a number at one moment; it says nothing about who controls it later.

Choosing the Right Product for the Job

Use an activation when the platform will not need the number again and you will remove it or never look back. Use a rental when the account will keep using the number, and set the renewal before you need it rather than after. Use neither for a primary bank or your main email, where a number in your own name and an authenticator app are the correct tools.

On every option, a private TempNumber.me number is yours for the period you hold it, which is the property that shared inbox numbers never have. View activation and rental pricing at /pricing.