How long does a carrier wait before reassigning my old number?

It varies by carrier and country, but many major US carriers use a dormancy window of around 45 to 90 days before releasing a disconnected number back into the available pool. Some prepaid carriers recycle numbers faster. There's no universal rule, so the safest approach is to assume your number could be reassigned within a few months and update your accounts before, not after, you cancel service.

Can I find out who has my old phone number now?

Generally no — carriers don't disclose who a reassigned number currently belongs to, both for privacy reasons and because numbers can change hands multiple times. The practical response is not to track the new owner but to make sure none of your accounts still rely on that number for verification or recovery, which removes the risk regardless of who ends up with it.

Is it safer to keep paying for a number I don't use anymore?

Keeping a dormant line active for a few extra weeks while you migrate accounts is a reasonable short-term buffer, but paying indefinitely isn't a long-term privacy strategy — it just delays the eventual reassignment. The more durable fix is switching your two-factor authentication and account recovery methods to an authenticator app or security key, so the phone number itself stops being a single point of failure.

What Actually Happens to Your Old Phone Number After You Switch

When you drop a phone number, a carrier can reassign it to someone else — here's how that exposes accounts tied to the old digits.

When you cancel or replace a phone number, it doesn’t vanish — most carriers recycle it and hand it to a new customer after a dormancy period, often as short as 90 days. That new owner can then receive your old password-reset texts, two-factor codes, and even calls from people who still have your number saved. This sits inside a wider pattern: Pew Research Center found that 81% of Americans say the risks of companies collecting their personal data outweigh the benefits, and separately, the same Pew study reports that 67% say they understand little to nothing about what companies do with data like phone numbers.

How a recycled number turns into a security hole

The process starts quietly. You switch carriers, drop a second line, or upgrade and let your old SIM lapse. The carrier marks the number inactive, waits out a cooling-off window, then reissues it to whoever signs up next. That person now controls a number that is still wired into dozens of your old accounts. Banks, email providers, and social platforms often use SMS as a recovery channel, and few people remember to update every single one before they let a number go. The new holder can trigger ‘forgot password’ flows on accounts they don’t own, receive one-time codes meant for you, or simply get a flood of calls and texts intended for someone else entirely. Some recipients report the opposite problem too: inheriting a number tied to debt collectors, old dating profiles, or an ex-owner’s unresolved disputes. Either direction, the link between a phone number and a real identity outlives the SIM card itself, because so many services treat the number as a permanent proof of you rather than a temporary one. What makes this especially slippery is that the exposure doesn’t announce itself. There’s no notification telling you that your number has been reassigned, and no dashboard showing which of your old accounts still point to a digit string you no longer control. The only signal, if there is one, is silence — you simply stop getting texts you used to get, and most people read that as a minor inconvenience rather than the start of a security gap. Meanwhile, the carrier’s job is just to manage inventory of numbers, not to track which online accounts might still be leaning on a given line for identity verification. That mismatch between what carriers manage and what account-recovery systems assume is really the root of the problem: a phone number was never designed to be a lifelong identity anchor, yet that’s exactly how banks, email providers, and social networks have come to use it.

A number with a second life

This illustrates a common pattern rather than a documented individual case.

This illustrates a situation many people encounter rather than a real individual’s story. Someone upgrades phones and lets their old prepaid number lapse after switching to a new plan. Three months later, a stranger activates that same number on a different network. Within a week, the stranger starts getting text codes from a food delivery app, a password reset from an old email account, and a call from a pharmacy confirming a prescription pickup. None of these services ever got updated with the new number, because the original owner assumed closing the SIM was enough. The stranger, now holding digits that still unlock fragments of someone else’s digital life, could in theory reset several accounts just by tapping ‘verify.’ Nobody broke in, no malware was involved, and no password was stolen — the exposure happened simply because a recycled number kept acting as a master key long after its original owner walked away. In some versions of this pattern, the new holder notices the mismatch and simply ignores the stray messages, deleting them without a second thought. In others, the temptation to poke at an unexpected ‘reset your password’ link is hard to resist, especially if the account name hints at something valuable, like a banking app or a crypto exchange. The outcome depends entirely on who ends up with the number next, which is precisely the problem — the original owner has no way to vet or even identify that person before the handoff happens.

How to retire a number without leaving the door open

Treat a phone number change like a security migration, not a simple swap. The fix isn’t to never change numbers — it’s to disconnect every account from the old one before the carrier reassigns it to someone else.

Audit every account tied to your number

Before you cancel a SIM, go through your email, banking, social media, and shopping accounts and check which ones list that number for two-factor codes or password recovery. Most account settings pages show this under ‘security’ or ‘contact info.’ Make a running list as you go so you don’t lose track halfway through.

Switch two-factor authentication to an app, not SMS

Move recovery and login codes to an authenticator app wherever the service allows it. This removes the dependency on a phone number entirely, so even if a stranger eventually activates your old digits, they can’t use them to reset anything important.

Update contact numbers before you cancel, not after

Change the phone number on file for each account first, confirm the change went through with a test code, and only then deactivate the old SIM. Doing it in the wrong order leaves a window where the old number is still live in someone else’s inbox of accounts.

Keep the old number active for a transition period if possible

If your carrier allows it, let a number sit dormant on your own account for a few extra weeks rather than releasing it immediately. That buffer gives you time to catch any account you missed before it becomes available for reassignment to a stranger.

Check for forgotten recovery emails and secondary numbers too

Phone numbers rarely sit alone as a recovery method — many accounts also list a backup email or a secondary number that may itself be outdated. While you’re auditing, confirm those fallback contacts are still yours as well, since a recycled backup channel can reopen the same risk even after you’ve fixed the primary number.

Why a privacy-focused VPN and monitoring habit still matters here

A phone number recycling problem isn’t solved by a VPN alone, but the broader exposure it reveals — how much of your identity rides on a single reused credential — is exactly the kind of risk a privacy tool is built to reduce elsewhere. Using a VPN with DNS leak protection keeps your browsing activity, including the account-recovery pages you visit while migrating numbers, from being logged against your real IP address by your ISP or by public Wi-Fi operators. That matters most during the exact moment you’re most exposed: logging into bank and email accounts from unfamiliar networks while you update contact details one by one. A no-logs policy means that activity trail isn’t sitting on a server somewhere waiting to be subpoenaed or breached later. Pairing that with a password manager that also stores backup codes for two-factor apps closes the loop: you stop treating a phone number as your only safety net for account recovery, and you stop generating a parallel data trail while you fix the problem. None of this replaces the manual audit from the steps above, but it removes one more place where your identity could leak while you’re in the middle of cleaning up after an old number. It’s also worth treating this migration period as a short window of elevated risk rather than a one-off errand. During the days or weeks it takes to work through a full account list, you’re logging into more services than usual, often from more networks than usual, which is exactly the kind of pattern that benefits from encrypted traffic and a password manager that flags reused or weak credentials along the way.