How to Geek recently laid out a checklist for this audit. Most of the evidence behind it comes from Princeton research published in 2021 and from federal rules on how long a disconnected number must sit unused. Both still hold up, and together they explain why this job has to happen before you hand the number back.
U.S. phone number recycling runs on a 45-to-90-day FCC clock
A phone number feels like it belongs to you, but it's leased from a finite pool. Under FCC rules, a disconnected number becomes an "aging number" that can't be given to anyone else for a set period. Numbers previously assigned to residential customers may be aged for no less than 45 days and no more than 90 days. Numbers previously assigned to business customers may be aged for no less than 45 days and no more than 365 days. That second rule matters to IT departments that give up corporate lines. They may get more time, but the minimum is the same 45 days.
The minimum is fairly new. The 45-day minimum aging requirement became part of the rule effective July 27, 2020, as part of the FCC's Reassigned Numbers Database Order. Before that, the FCC observed that the rules set only a maximum, so a number used by one consumer today can be reassigned to another consumer almost immediately. In the same proceeding, the marketing firm Tatango told the FCC that some of the largest wireless carriers reassign disconnected numbers to new consumers in as few as two days.
The FCC designed the waiting period to cut down on misdirected robocalls, not to protect your accounts. According to NANPA, the numbering administrator, the minimum helps ensure the accuracy and effectiveness of the Reassigned Numbers Database in protecting consumers from receiving unwanted calls intended for someone who previously held their number. No website checks that database before it sends a password-reset code. After 45 days the number can go to someone else, and your accounts stay exactly as you left them.
The timeline can also stretch. After disasters, the FCC has temporarily waived the 90-day maximum so customers can suspend service and reclaim their numbers later. In a January 2025 order covering California wildfire areas, the Commission said: "We do not waive the 45-day minimum aging" period. These rules apply only in the U.S. Other countries set their own timelines, and a traveler or someone who has moved abroad shouldn't assume any of these figures apply.
Princeton's 259-number sample shows how recycled numbers expose previous owners
Princeton researchers Kevin Lee and Arvind Narayanan published the most detailed look at this problem. Their project site starts from the fact that 35 million phone numbers are disconnected in the U.S. every year. Standard industry practice is to reassign those numbers to other subscribers. They presented the work at the 2021 APWG Symposium on Electronic Crime Research (eCrime). It's a few years old and was never a fresh 2026 finding, and it covers two U.S. carriers during a single study period.
The team sampled 259 numbers that T-Mobile and Verizon were offering to new subscribers and checked them against six major sites. 171 of 259 numbers we sampled were vulnerable to account hijackings at six popular websites: Amazon, AOL, Facebook, Google, Paypal, and Yahoo. The method was simple. An attacker can cycle through the available numbers shown on online number change interfaces and check if any of them are associated with online accounts of previous owners. If so, the attacker can then obtain these numbers and reset the password on the accounts, and receive and correctly enter the OTP sent via SMS upon login.
A second finding shows why SMS two-factor authentication alone doesn't fix this. 100 of the 259 numbers were linked to leaked login credentials on the web, which could enable account hijackings that defeat SMS multi-factor authentication. The researchers used people-search sites to find each previous owner's email address, then checked those addresses on Have I Been Pwned. If the owner's password had leaked in a breach, the attacker could log in with it and needed the recycled number only to catch the SMS code. They never had to trigger a password reset.
Overall, most of the available phone numbers we sampled (215 of 259) were recycled and also vulnerable to at least one of the three attacks—PII indexing, account hijackings via recovery, and account hijackings without password reset. These figures describe that sample. They don't mean two-thirds of every recycled number today opens someone's accounts. What they do show is that a number linked to live accounts is easy to obtain.
Recycled numbers are easy to find, and unintended messages keep arriving
Attackers don't have to guess which numbers are recycled. The researchers noticed that carriers list available numbers grouped by their first six digits, and if no two available numbers are within 10 of each other, then all the numbers in the NPA-NXX are likely recycled. They also found that the online number change interfaces at both carriers imposed few restrictions on the adversary's ability to browse and obtain vulnerable recycled numbers.
You don't need a criminal on the other end for this to go wrong. We obtained 200 recycled numbers for one week, and found 19 of them were still receiving security/privacy-senstive calls and messages (e.g., authentication passcodes, prescription refill reminders). The researchers warn that new owners who get these messages may realize the incentives to exploit upon receiving unsolicited sensitive communication, and become opportunistic adversaries.
For some people the stakes are higher. Among five further attacks, the paper describes a "targeted takeover": someone learns that a person has changed numbers, watches the aging period, and grabs the old number once it's released. They list the population most at risk as previous owners, especially intimate partner violence (IPV) survivors changing their numbers to escape abusers. If you're changing numbers to get away from someone, unlinking your accounts is part of your safety, not just housekeeping.
The carriers did respond to the research. In December 2020, T-Mobile informed us that after reviewing our research, it had updated its number change support page to 1) remind subscribers to update their contact number on bank accounts and social media profiles, and 2) specify the FCC-mandated number aging period. Verizon made similar changes to its support documents. Those changes amount to warnings. Updating your accounts is still your job.
The account audit has to happen while the old number still works
The Federal Trade Commission gives the same basic advice: if you're not keeping your phone number, update the number on file with any accounts or services that use it to identify you. Timing is the hard part. Many services send a code to the number currently on file before they'll let you change security settings, so a dead line can lock you out of your own fix. Keep the old and new numbers active until you're done.
Step 1: Build the inventory before you touch settings
The accounts you remember are rarely all of them. How to Geek suggests searching your email for phrases such as "verification code," "confirm your phone number," and "security alert," and looking through your password manager for entries you haven't opened in years. Those are sensible ways to find accounts, but they won't catch everything. Put the accounts that can recover other accounts at the top of the list:
- Your primary email account and your Apple or Google account, which can reset access to many other services.
- Your mobile carrier account, which controls the number itself.
- Banks, PayPal and other payment services, and crypto exchanges.
- Cloud storage, shopping accounts, and social networks.
- The quieter services: pharmacy and healthcare portals, airline and hotel loyalty programs, delivery apps with saved cards, and utility accounts.
Step 2: Check every role the phone number plays
A number can sit in several places inside one account. For each one, open the security settings and look at the recovery phone number, the two-factor authentication method, and any option that lets you sign in or reset your password by text. Replace the old number, or better, add a method that doesn't depend on a phone number: an authenticator app, a passkey, or a hardware security key. If a service offers only SMS, move it to the new number and mark it as a weak spot to come back to.
One caution runs the other way. The FTC notes that if you use an authenticator app to log in to any accounts, you may have to reactivate it. If you're changing phones at the same time as numbers, move your authenticator app and confirm it works before you wipe the old device.
Step 3: Move messaging identities from inside the apps
WhatsApp, Telegram, and Signal all use your phone number as your account identity, and each has a change-number option. Use it before you give up the old line instead of reinstalling later. Signal's documentation is the most specific. Change Number is supported if you are using an active Signal account. To test, send a message to the Note to Self contact. can receive SMS to your new number. It is not supported if you do not have your old device or lost your phone. cleared your phone. cannot receive SMS to your new number.
The path is Signal Settings > Account > Change Phone Number. Signal warns that you will not be able to undo this. Check the new number carefully before you confirm. Your username carries over, and contacts you've chatted with may see a notice in the chat that your number changed.
Step 4: Confirm, save backups, and delete what you don't use
Save backup codes wherever a service offers them, and store them offline. How to Geek suggests signing out and back in to confirm each change took effect. Before you do, make sure you have a working second recovery method, because recovery flows differ from service to service. Finally, delete dormant accounts instead of updating them. An abandoned login with an old number attached is the easiest thing for an attacker to find in the Princeton method.
What to do with the old number once the audit is done
If you can afford it, keep the old line alive for a while. You can move it to a low-cost plan or a VoIP service that accepts ported numbers. The Princeton researchers suggested cheap number parking alongside unlinking your accounts first. Fees, eligibility, and porting rules vary by carrier and provider, so check the cost before you commit.
If the number is already disconnected, the FCC clock tells you how urgent this is. It can't go to anyone else for at least 45 days, and a residential number can age for up to 90. Contact your former carrier right away and ask whether it can reactivate the number. Some carriers allow this for a limited time and some don't. Meanwhile, work through the same list using each service's official account recovery process, starting with email and anything that holds money.
After that, rely less on SMS. Move important accounts to an authenticator app, passkeys, or a hardware key. Protect your carrier account with a PIN or number lock if your carrier offers one, which makes unauthorized port-outs harder.
For businesses, the inference is simple. The FCC lets business numbers age for up to 365 days, but the 45-day minimum is the same as for residential lines. If you give up company lines when staff leave or plans change, any work systems that allow SMS as a sign-in or recovery method may still point at those numbers. Put phone-number cleanup on the same offboarding checklist as revoking laptops and badges.
What this means for you
If you're about to change numbers or carriers, do the audit now, before you cancel anything. If you're keeping your number, you can wait, but checking your SMS-only logins is worth doing either way.
- Keep your old line active until every critical account is updated, because services often send a verification code to the number already on file.
- Start with your primary email, your Apple or Google account, your carrier account, and financial services, since those can reset access to most other accounts.
- Check the recovery phone, the SMS two-factor setting, and any text-based sign-in or reset option in each account. Replace SMS with an authenticator app, passkey, or hardware key where the service allows it.
- Change your number inside Signal, WhatsApp, and Telegram before the old line goes dead. Signal's Change Number requires an active account, your old device, and a new number that can receive SMS.
- Delete dormant accounts instead of updating them, and save backup codes offline.
- For the next few months, watch for password-reset emails you didn't request and unfamiliar login alerts. If you see one, change the password, sign out of other sessions, and contact the service.
Phone number recycling is a normal, regulated part of how U.S. carriers keep ten-digit numbers available, and it isn't going to stop. The FCC's 45-day minimum gives you a head start before someone else gets your number, and the Princeton data shows how often accounts are still linked when that happens. The next time a line gets cancelled in your household or your organization, update the accounts first and release the number after.