The Ghost in Your Old Number: Why Security Codes Still Land There

There is a small, specific dread that comes with changing your mobile number. Not the admin of telling friends. Not the faff of updating your details on a dozen websites. It is the moment, months or years later, when you realise a security code has gone to a number you no longer own.

In the UK, mobile numbers are a finite resource. They get recycled. That is sensible housekeeping by the networks, but it creates a quiet problem for anyone who treats a phone number as a permanent key to their online life. Because when a number changes hands, the accounts attached to it do not automatically follow.

The handover you never see

When you leave a network or cancel a SIM, the number does not vanish. After a period, it can be returned to the pool and given to someone else. The exact timing depends on the network and the type of contract or prepaid deal, so there is no single rule of thumb. The important part is simpler: a number you gave up can eventually become someone else's number.

Most of the time, that is harmless. The new owner gets a fresh SIM, maybe a few stray marketing texts, and life goes on. The trouble starts when an account still lists your old number as a recovery phone. That could be an email account, a bank, a social network, a delivery app, or a government service. If someone requests a password reset or a login code, the message goes to the person holding the SIM now.

They may not be trying to break in. They may simply receive a text that was meant for you. But the risk is real: a recovery phone is a spare key. If the new owner is unscrupulous, or if your email is also compromised, that stray code can become the first step in an account takeover.

If you have inherited someone else's number

Getting a new number and finding it already attached to strangers' accounts is more common than people expect. You might get verification texts for a previous owner, reminders about appointments, or password resets for services you have never used.

The right instinct is to do nothing with those codes. Do not try the code on a login screen. Do not use a 'forgot password' form to poke around. You are not the account holder, and using someone else's recovery route can land you in awkward territory.

Practical steps: ignore one-off messages. Reply STOP to obvious marketing. If you keep getting bank codes, call the bank using the number on its official website or the back of a card, explain that your new number is receiving security texts for someone else, and ask them to note it. You can also ask your network whether anything can be done, though they cannot usually edit third-party accounts. If the messages are relentless, a fresh number may be the least stressful option.

The audit: find what still points at the old number

This is the bit most people skip. Before you cancel a number, or as soon as you remember an old one is still attached somewhere, make a list. Start with the accounts that could cause the most damage: your main email address, online banking, credit cards, pension, payroll, and any cloud storage or social account that can be used to reset the others.

Then search your inbox for phrases like 'verification code', 'security code', 'two-factor', and 'recovery phone'. Old emails are a surprisingly good map of where your number was used. Check the security settings on each account. If the old number is still listed, add your current number first, verify it, make it the primary contact, and only then remove the old one.

Where possible, move away from SMS codes altogether. An authenticator app or a passkey is less exposed to number recycling. Print or save the backup codes. Add a second email address that you actually control. For UK government services, check GOV.UK One Login, HMRC, DVLA, and NHS login if you use them; each has its own recovery settings.

What to say to your mobile network

If you still have the old SIM and want to keep the number, ask the network what you need to do to stop it going dormant. On pay-as-you-go, that may mean making a charge or using the SIM occasionally. If the number has already gone, ask whether it is recoverable. Often it will not be, especially once it has been reassigned.

If you are the one receiving codes for a previous owner, be clear and calm: 'I have a new number and I am receiving security codes for someone else.' Ask if they can block nuisance messages or advise on a replacement. If you suspect your own number has been hijacked through a SIM swap, call your network immediately and ask them to lock the SIM and investigate. Then change passwords from a secure device and tell your bank.

A small habit that saves a lot of grief

Treat your phone number like a forwarding address, not a permanent fixture. When you change it, update the important accounts before the old SIM dies. When you close an account, remove the phone number if you can. And if you are offered app-based two-factor authentication or a passkey, take it. The ghost in your old number only has power while accounts still believe it is yours.