The Recovery Route in Your Pocket: A UK Audit for Old Mobile Numbers

For many UK households, a mobile number feels like a personal fixture. It is printed on forms, stored in banking apps and used as a fallback when a password is forgotten. Yet a number is not owned by the person who uses it. It is allocated by a mobile operator and, in time, can be returned to the pool and issued to someone else. That possibility matters because the number in your pocket is often also a recovery route into accounts that have nothing to do with phone calls.

Why a number can outlive the handset

When a UK mobile contract ends, the handset may be returned, sold or recycled. The number follows a different path. If the customer asks for a PAC code and ports the number to a new provider, it stays with them. If they simply let the contract lapse, the SIM is eventually deactivated and the number may be reclaimed by the operator after a dormant period. The exact timetable is not uniform. UK numbering is overseen by Ofcom, but allocation and recycling are operational matters for providers, and practices vary.

The practical point is straightforward: handing back a phone does not detach the number from the accounts that used it. Nor does cancelling a contract automatically update an email provider, a bank or a social network. Those systems hold the number as a contact detail or a security check until someone changes it.

How UK numbers are reused

Recycled numbers are a normal part of a finite numbering system. A new customer may receive a number that previously belonged to someone else, along with any messages intended for the former owner. Most of the time this is harmless: a stray delivery notification, a reminder from a gym, a call from a number that was never saved. The risk arises when the former owner left that number attached to an account recovery process.

A password reset sent by SMS can land on a stranger’s handset. A one-time code intended to confirm a login can be delivered to the wrong person. In most well-designed systems, a single SMS code is not enough on its own to take over an account. But it can be one link in a chain, particularly where an old number remains listed as a backup route years after it was last used.

The recovery route people forget

The first account to audit is usually email, because email is the master key for so many others. If an old mobile number is still listed as a recovery phone on a personal email account, a password reset request may offer SMS as an option. Banking and card apps deserve the same attention, even where they rely mainly on app-based authentication. Many will still hold a mobile number for alerts, device verification or account recovery.

Social media, shopping accounts, cloud storage, subscription services and workplace systems can also retain an old number. Less obvious places include government services, delivery apps and any platform where the number was used as a username or a two-factor method. The audit should therefore ask two questions: where is this number listed as contact information, and where is it used as a security check?

Porting, SIM swaps and the difference

Porting a number is a legitimate process. A PAC code allows a customer to move an existing number to a new network, and it is the usual way to keep a number when switching providers. A SIM swap is different. In a fraudulent SIM swap, someone persuades a mobile operator to transfer a number to a SIM or eSIM they control. The aim is to intercept calls and messages, including security codes.

Operators have controls intended to prevent this, such as account PINs, identity checks and restrictions on SIM changes. Customers should ask what protections are available on their account and whether a port freeze or additional verification can be applied. These measures are useful, but they do not replace good recovery hygiene. A number that is no longer yours cannot be protected by your new provider.

A practical audit before you switch or hand back a phone

Start before the old number stops working. Make a list of accounts that use it, beginning with email, banking, social media and any service that holds payment details. Update the recovery number to a number you will keep. Where possible, replace SMS-based two-factor authentication with an authenticator app, a passkey or a hardware security key. Download or print backup codes and store them securely, rather than leaving them in an inbox that may itself depend on the old number.

Check whether the number is used as a username or login identifier. If it is, change the login details where the service allows. Contact the mobile operator to understand what happens to the number after cancellation and whether it can be retained on a low-cost arrangement. If you are handing back a handset, remove the SIM or delete the eSIM profile, sign out of accounts and wipe the device. A factory reset protects the handset’s data; it does not update the account records held elsewhere.

If the number has already been reassigned

Act promptly rather than waiting for a suspicious message. Change passwords from a trusted device, revoke active sessions and update recovery details. Contact the bank or card provider if the number was linked to financial accounts, and ask for additional monitoring where appropriate. Report suspected fraud to Action Fraud and keep records of what was changed and when. If an account has been compromised, follow the provider’s account recovery process and consider guidance from the National Cyber Security Centre.

The bottom line

A mobile number is a convenience, not an identity. In 2026, as eSIM switching becomes more common and number porting remains routine, the recovery route in your pocket deserves the same attention as the handset itself. An annual audit is modest work: list the accounts, update the number, strengthen the authentication and remove details that no longer belong to you. The alternative is to discover the gap only when a stranger receives the code that was meant for you.