Your Old Phone Number Could Still Unlock Your Accounts: What to Remove Before It’s Too Late
Changing your mobile number may feel like a clean break, but your old number does not simply vanish. In many cases, it returns to the mobile operator and can later be assigned to someone else. If that number is still connected to your Google account, Apple ID, PayPal, bank login, email account, WhatsApp, or online shopping profile, the next owner may receive security codes meant for you.
That creates a serious account security risk. One-time passwords sent by SMS are often treated as proof of identity. But if the number no longer belongs to you, those codes may go straight to a stranger.
This is especially important in Germany, where there is no legally required waiting period before a disconnected mobile number can be reassigned.
What happens to your old mobile number?
Most people keep their number when switching mobile providers. But not everyone does. You might cancel a prepaid SIM, close a second phone contract, switch to a new number, or let an old card expire. Once the contract ends, the number goes back to the mobile provider.
Under German numbering rules, a number assigned by a provider returns to that provider when the related telecom contract ends. The law does not specify a mandatory quarantine period before that number can be given to another customer.
That means the waiting time depends on the mobile operator’s internal policy. Some providers may hold numbers for months, while others may release them much sooner. Deutsche Telekom has previously described cases where old numbers may be released again after as little as 30 days.
The danger is simple: many online accounts continue to trust that number long after you stop using it.
Why recycled phone numbers are a security problem
Phone numbers are widely used for account recovery and two-factor authentication. They are attached to services such as:
Google accounts
Apple IDs
Microsoft accounts
PayPal
Amazon
Banking apps
Email accounts
Social media profiles
WhatsApp and messaging services
If your old number remains linked to any of these accounts, the new owner of the number may receive password reset messages, login verification codes, or security alerts.
This does not always mean instant account takeover. A password may still be required. But many services allow phone numbers to be used for recovery, identity verification, or account reactivation. In the wrong situation, a recycled number can become the weakest link in your digital security.
Research shows the risk is real
A study by researchers Kevin Lee and Arvind Narayanan at Princeton University examined recycled mobile numbers in the United States. They purchased 259 available numbers from major mobile carriers and checked whether old online accounts were still connected to them.
The results were concerning. For 171 of the 259 numbers, about 66 percent, at least one account belonging to the previous owner was still linked to the number. Those accounts included major platforms such as Amazon, AOL, Facebook, Google, PayPal, and Yahoo.
In a second test, the researchers monitored 200 recycled numbers for one week. Nineteen of them received security-related messages during that short period. Six received one-time login codes from major services including Apple, Google, Microsoft, Facebook, and WhatsApp.
The study was conducted in the US and is several years old, so the exact numbers may not apply directly to Germany or other countries. However, the basic issue remains the same everywhere: if people forget to remove old phone numbers from their accounts, the next owner may receive sensitive security messages.
Germany has no mandatory waiting period
The comparison with the United States is notable. In the US, the Federal Communications Commission requires mobile providers to wait at least 45 days before reassigning a disconnected number, with a maximum aging period of 90 days for consumer accounts.
Germany does not currently have a comparable legal minimum waiting period. The number may return to the provider immediately after the contract ends, and the provider decides when it becomes available again.
This is not necessarily due to a shortage of mobile numbers. Germany’s telecom regulator has listed hundreds of large mobile number blocks as still available. Reassigning numbers is therefore often an operational decision rather than an unavoidable necessity.
SIM swapping is another route of attack
Recycled phone numbers are not the only problem. Another risk is SIM swapping, where an attacker tricks a mobile provider into transferring your number to a new SIM card.
In Germany, number porting checks typically rely on customer details such as name, address, date of birth, and the number being transferred. Unfortunately, these details are not truly secret. They often appear in data breaches, leaks, phishing databases, or stolen customer records.
Some providers offer additional customer passwords or personal codes for support interactions, but protection varies. In some cases, a customer password adds another layer; in others, stronger verification may depend on a personal customer code or PUK.
SIM swapping is not considered a mass-scale problem in Germany at the moment. Major providers and law enforcement have not reported a major nationwide surge. Still, for targeted attacks against individuals, business owners, journalists, crypto users, executives, or people with high-value accounts, the effort required may be low enough to matter.
Why SMS two-factor authentication can become a weakness
Two-factor authentication is supposed to make accounts safer. But SMS-based verification has a major flaw: it is tied to a phone number, not necessarily to you.
If your number is reassigned, stolen through SIM swapping, or still used as a recovery method after you cancel it, SMS can undermine stronger security measures.
This is especially risky when a service allows a phone number to reset a password or bypass another form of authentication. In that case, the SMS code becomes a single point of failure.
A strong password and two-factor authentication can be weakened if account recovery still depends on an old mobile number.
What you should do before giving up a phone number
Before cancelling a SIM card or switching to a new number, remove the old number from your most important accounts. Do this before the number is disconnected.
Start with accounts that control money, identity, communication, or access to other services:
Primary email account
Secondary email accounts
Google account
Apple ID
Microsoft account
PayPal
Online banking
Credit card apps
Amazon and major shopping accounts
Social media accounts
Messaging apps such as WhatsApp
Cloud storage accounts
Password managers
Government and tax portals
Work accounts and business tools
Check both security settings and recovery settings. Many services store phone numbers in more than one place, such as login verification, account recovery, contact details, and payment verification.
Replace SMS with safer login methods
Where possible, stop using SMS as your main second factor. Better alternatives include:
Authenticator apps generate codes on your device rather than sending them through the mobile network. Passkeys are even stronger because they are tied to your device and protected by biometrics, PIN, or hardware security. Hardware security keys offer very strong protection for high-risk users.
Once a safer method is active, many services allow you to remove the phone number as a recovery option entirely.
Do not forget old and rarely used accounts
The most dangerous accounts are often the ones you forgot about. An old email account may still be connected to password resets for dozens of services. A forgotten PayPal account may still contain old payment details. A neglected cloud account may store personal documents, photos, or backups.
Search your password manager, email inbox, and browser-saved logins for accounts linked to your old number. Look for terms such as “verification code,” “phone number,” “recovery,” “security alert,” and “two-factor authentication.”
The correct order matters
If you plan to stop using a mobile number, follow this order:
First, sign in to all important accounts.
Remove the old number from login, recovery, and contact settings.
Add your new number only where necessary.
Set up an authenticator app, passkey, or security key.
Confirm that you can log in without the old number.
Only then cancel the old SIM or contract.
Doing it the other way around can leave you locked out while someone else receives the codes.
The bottom line
Your old phone number may remain a key to your digital life long after you stop using it. Because recycled mobile numbers can receive login codes and recovery messages, every outdated number linked to your accounts is a security risk.
The safest move is simple: remove phone numbers you no longer control, replace SMS authentication with stronger methods, and clean up account recovery settings before cancelling any mobile number. A few minutes of checking today can prevent a serious account takeover later.
