The SIM You Handed Back Is Still on the Guest List
Photo by Photo by Ottr Dan on Unsplash on Unsplash
Most of us treat a mobile number like a nickname. It is not. It is a login, a recovery route and, for a lot of UK accounts, the thing that proves you are you when you have forgotten your password at 11pm. So when a contract ends, a cheap SIM deal tempts you, or a work phone gets handed back, the digits do not simply retire to a quiet shelf. They can be recycled.
That is the bit worth pausing on. Porting your number to a new network is usually fine — the digits travel with you. The risk arrives when you take a new number and leave the old one behind. Eventually it can be reassigned to a stranger. Every account that still lists it as the place to send a reset link or a one-time code is now holding a spare key for someone else.
Why a phone number is more than a contact detail
Banks, email providers, WhatsApp, HMRC, payroll systems, domain registrars and marketplace logins all use mobile numbers as a shortcut. Sometimes it is the second factor. Sometimes it is the only factor. Sometimes it is the quiet back door labelled 'forgot password'.
If that number moves on, the new owner does not need to know your name. They only need to request a code and watch it arrive. That is why a number-recycling audit belongs next to your password clean-up — especially before a busy shopping season and the January contract shuffle.
The leaving audit: start with money and identity
Before you cancel a line or take a new number, make a list. Not a mental list. A real one, in a notes app or on paper.
Start with anything that can move money or change your official record: current accounts, savings, credit cards, PayPal, Klarna and similar, HMRC and GOV.UK One Login, payroll, pensions, DVLA, council tax and your GP or NHS app if it uses your mobile for verification. Log in, find the security or contact details page, and change the number. If you cannot change it online, ring the organisation from the number on its official website — not from a link in an email.
Then do the inboxes. Your email account is often the master key for everything else. Update Google, Microsoft, Apple and any password manager you use. If your email recovery address is also the old mobile number, fix that too.
Do not forget the loud accounts: WhatsApp, iMessage and FaceTime, social media, and any messaging app where a code can re-register your identity. WhatsApp has a specific change-number option in settings; use it rather than simply swapping SIMs and hoping.
Then the quiet accounts that still hold keys
The dull ones matter. Domain registrars and web hosting accounts can be hijacked with an email reset, and the mobile number is often the backup. Loyalty schemes, supermarket apps, delivery accounts, gyms, libraries, car parks, marketplace logins such as eBay, Vinted and Facebook Marketplace, and old retail accounts you have not used since 2019 — all of them can hold a code route.
You do not have to delete every account. You do have to decide which ones still matter and update the number on those. For the rest, close them if you can. An abandoned account with your old number is not neutral; it is an open window with a note on it.
The small-firm version: shared phones and ex-staff numbers
Micro-firms have the same problem, only with more people involved. A shared business mobile may be the recovery number for the business bank, the payroll portal, HMRC's business tax account, the domain registrar, the Google Business Profile and the social accounts. When that handset is upgraded or handed to a new starter, the recovery route changes hands too.
Then there is the ex-staff problem. A former employee's mobile number may still be on the 'Contact Us' page, a Companies House filing, a review site or an old invoice template. Removing the name is not enough. If the number is still used for verification codes, it is still a key. Update the public listing and the back-end account settings separately; they are not the same job.
A simple routine helps: keep a shared spreadsheet of every business account, the mobile number attached to it, and who owns that number. When a phone leaves the business, treat it like a set of keys. Collect it, change the recovery details, and note the date.
When a code arrives that you did not ask for
Do not forward it. Do not read it out to anyone who rings you, even if they claim to be from your bank or network. Do not tap a link in a message that says your account is at risk.
Instead, log in to the account directly using its official website or app. Check the contact details and recent activity. If the number is one you are about to give up, bring the audit forward. If it is an account you do not recognise, contact the provider. And if you keep getting codes for an account you no longer use, that is a good reason to close it rather than leave it open.
The five-minute closing check
Before you let a number go, ask: can this account move money, change my identity, or lock me out of something important? If yes, update it today. Can someone use it to re-register a messaging account? Update it. Is it only a loyalty card from a shop you no longer visit? Close it or accept the small risk.
A mobile number feels personal, but it is really a piece of infrastructure. Treat it like one. The guest list should be checked before the SIM leaves your hand — not after someone else starts receiving your post.
