Follow Us on Google
How SIM reassignment is exposing Nigerians to privacy, security threats
As Nigeria’s digital economy deepens, a mobile phone number is no longer just a means of making calls or sending text messages. It has become a digital identity linked to bank accounts, Bank Verification Numbers (BVN), National Identification Numbers (NIN), pension records, digital wallets, social media accounts and a growing number of online services.
That transformation has also created an emerging challenge. What happens when a phone number carrying someone else’s digital history is reassigned to a new subscriber?
For an increasing number of Nigerians, that question is no longer hypothetical. A recent experience shared by a subscriber, Mr. Ifeanyi Obi, on Facebook has brought the issue into sharp focus, raising fresh concerns about the privacy, security and consumer protection implications of recycled phone numbers in an increasingly interconnected digital ecosystem.
According to the subscriber, he had purchased a SIM card for business purposes and specifically requested a number that had never been used before to avoid potential complications.
He was assured that a number would be assigned upon activation. What followed, however, was anything but routine.
Shortly after activating the line, he began receiving debit and credit alerts intended for another individual. Transaction notifications linked to a stranger’s bank account started appearing on his phone.
Concerned, Obi contacted customer care and was assured that the matter would be escalated. A bank official also reached out to determine whether he was the account holder linked to the number. When he explained that he was a new subscriber, the bank reportedly referred him to the telecommunications provider, while the provider advised him to contact the bank.
Caught between two institutions, Obi was left wondering how a newly acquired phone number could still be connected to another person’s financial identity.
His experience has reignited debate over the recycling of inactive phone numbers, a long-standing telecommunications practice that is increasingly colliding with the realities of Nigeria’s digital economy, where a mobile number has evolved from a communication tool into a key that unlocks financial services and digital identities.
The subscriber’s experience comes at a time when mobile phones have become the backbone of Nigeria’s digital economy.
According to the Nigerian Communications Commission (NCC), active mobile subscriptions stood at approximately 179.64 million as of December 2025, underscoring the extent to which Nigerians depend on mobile numbers for communication, banking, digital payments and access to online services.
Data from GSMA Intelligence also indicates that Nigeria had about 165 million cellular mobile connections at the end of 2025, representing approximately 69.2 per cent of the country’s population.
The pace of digital adoption continues to accelerate. In the first quarter of 2026 alone, Nigerians consumed a record 4.06 million terabytes of internet data, while spending an estimated ₦3.33 trillion on mobile data services.
For millions of Nigerians, a mobile phone number is now far more than a communication tool. It serves as a digital credential linked to bank accounts, Bank Verification Numbers (BVN), National Identification Numbers (NIN), pension records, insurance platforms, fintech wallets, healthcare portals, e-commerce accounts and social media profiles.
As this digital ecosystem expands, inheriting a recycled phone number may increasingly mean inheriting part of another person’s digital identity.
The reassignment of inactive phone numbers is a long-standing practice in the global telecommunications industry.
Like many countries, Nigeria has a finite numbering resource. To ensure efficient utilisation, dormant numbers are eventually returned to operators and reassigned to new subscribers after meeting regulatory conditions.
Industry reports indicated that a mobile number may become eligible for reassignment after approximately 360 days of inactivity, although subscribers who wish to retain inactive lines may make use of line retention services where available.
While the policy helps conserve scarce numbering resources, experts argued that the rapid expansion of digital services has fundamentally changed the implications of number recycling.
Years ago, abandoning a phone number meant little more than missing a few calls or text messages.
Today, it could leave behind links to dozens of financial institutions, fintech applications, government platforms and online accounts, exposing both former and new users to unintended consequences.
For industry stakeholders, the convergence of telecommunications and financial services has fundamentally altered the role of mobile numbers.
The Chief Corporate Services and Sustainability Officer of MTN Nigeria, Tobechukwu Okigbo, said the convergence of telecommunications and banking has fundamentally changed the role of mobile phone numbers in Nigeria’s digital economy.
According to him, telecom networks now underpin a significant portion of the country’s financial ecosystem, supporting one-time passwords (OTPs), USSD banking, digital transfers, fintech authentication and agent banking services. This, he said, means that once a SIM card is compromised, the security implications extend beyond telecommunications into the financial system.
“The phone number has effectively become part of the password,” Okigbo said.
He explained that one of the most overlooked vulnerabilities is the lifecycle of phone numbers. Even after a number is recycled and reassigned, traces of the previous owner’s digital identity may remain linked to banking systems, fintech platforms, merchant services and social media accounts.
“Even if the original user changes their number, not all systems update instantly. Some banking records, fintech profiles and merchant services may still hold the old number,” he said.
Okigbo, however, argued that the responsibility cannot rest on telecom operators alone. According to him, while operators recycle inactive numbers in line with regulatory requirements, banks and other digital service providers must ensure obsolete phone numbers are promptly removed from customer records.
He noted that consumers do not own mobile phone numbers permanently but only have the right to use them under the regulatory framework governing numbering resources. As such, inactive numbers may eventually be reassigned after due process.
He proposed a more integrated framework under which banks would receive real-time notifications whenever numbers are swapped, deactivated or reassigned, enabling them to immediately delink old numbers from customer accounts and trigger fresh verification before approving sensitive transactions.
“Banks and telecom operators need to build a more coordinated security architecture together,” he said, warning that isolated controls within each sector would continue to leave exploitable gaps.
Okigbo also advised subscribers particularly Nigerians in the diaspora to pay close attention to line retention requirements, noting that inactive numbers may eventually be recycled if they are not actively maintained in line with regulatory provisions.
While receiving another person’s banking alerts is in itself a serious privacy concern, cybersecurity experts warn that the dangers associated with recycled phone numbers run much deeper.
International research suggested that recycled numbers can become gateways to identity theft, account takeover and financial fraud if digital accounts remain linked to previous owners.
A landmark study by researchers at Princeton University, led by Kevin Lee alongside Professor Arvind Narayanan and colleagues, found that approximately 66 per cent of sampled recycled phone numbers remained linked to online accounts belonging to previous users.
The researchers identified multiple attack scenarios in which recycled numbers could potentially be exploited for password resets, account recovery processes and unauthorised access to digital services.
According to the researchers, as mobile phone numbers increasingly serve as digital identities, recycling them without adequate safeguards presents significant security and privacy risks.
For Nigeria, where phone numbers are increasingly tied to banking services, Bank Verification Numbers (BVN), National Identification Numbers (NIN), pension accounts, fintech applications and government services, the findings carry profound implications.
Cybersecurity experts said a fraudster who gains control of a recycled number that remains linked to a previous owner’s accounts may be able to intercept one-time passwords (OTPs), reset passwords, authorise USSD transactions or gain access to digital platforms that still recognise the number as belonging to the former user.
Several Nigerians have shared experiences of losing money after inactive phone numbers were reportedly reassigned while still linked to their financial accounts.
The issue has become particularly pronounced among Nigerians in the diaspora, many of whom leave their local SIM cards inactive for extended periods without realising that the numbers may eventually be recycled under existing regulations.
Recognising the growing risks posed by recycled, swapped and churned mobile numbers, the Nigerian Communications Commission (NCC) has begun implementing measures aimed at strengthening mobile identity management.
Earlier this year, the Commission unveiled the Telecoms Identity Risk Management System (TIRMS), a platform designed to enable telecom operators, banks, fintech companies, regulators and other authorised institutions to verify the status of mobile numbers in real time before authorising sensitive transactions.
The platform is expected to provide information on recycled, swapped, churned and fraud-flagged numbers, helping organisations strengthen customer verification processes and reduce opportunities for identity-related abuse.
Speaking at the launch of the initiative, the Executive Vice Chairman and Chief Executive Officer of the NCC, Dr. Aminu Maida, said the increasing reliance on mobile numbers as digital identities had made it imperative to address vulnerabilities associated with recycled and swapped numbers.
According to him, the fraudulent use of churned, recycled, swapped and barred numbers has become “a significant vector for financial fraud and identity theft,” making stronger collaboration among telecom operators, financial institutions, regulators and other stakeholders essential to protecting consumers and preserving trust in Nigeria’s digital ecosystem.
The Commission has also proposed reforms requiring telecommunications operators to provide a 14-day notice before deactivating dormant SIM cards, while strengthening reporting obligations around the reassignment of inactive numbers.
The reforms are expected to improve transparency and provide subscribers with an opportunity to retain numbers they still wish to use.
Industry stakeholders believe the challenge cannot be solved by telecom operators alone.
Okigbo maintained that banks must play a more active role by ensuring that obsolete phone numbers are promptly removed from customer profiles once subscribers change or lose access to their numbers.
He argued that financial institutions should receive real-time notifications whenever numbers are swapped, deactivated or reassigned so they can immediately suspend sensitive links associated with previous owners and initiate fresh verification processes.
Telecommunications consumer advocate and President of the National Association of Telecoms Subscribers (NATCOMS), Chief Adeolu Ogunbanjo, has consistently called for stronger consumer protection measures within the telecommunications sector.
He believes subscribers should not bear the consequences of systemic gaps in mobile identity management, stressing that stronger coordination among telecom operators, banks and regulators has become increasingly necessary as mobile numbers evolve into digital identities.
David Isiavwe, Chief Information Security Officer at Interswitch, has repeatedly advocated stronger digital identity management and greater collaboration among ecosystem players to combat fraud and strengthen trust in digital services.
His position reinforced growing calls for tighter controls over the reassignment of mobile numbers, particularly as financial institutions continue to rely on phone numbers as key identity credentials.
Experts say protecting consumers will require a combination of stronger regulation, better technology and greater public awareness.
Banks and fintech companies must encourage customers to promptly update their phone numbers across all financial platforms whenever they change numbers.
Telecommunications operators, on their part, will need to continue strengthening procedures around SIM deactivation and number reassignment, while ensuring customers are adequately informed about line retention options.
Cybersecurity experts advised subscribers to delink abandoned phone numbers from banking services, email accounts, social media platforms and other digital services before discontinuing their use.
As Nigeria’s digital economy continues to expand, the humble mobile phone number has evolved into one of the country’s most important identity credentials.
Ensuring that a new phone number does not come with someone else’s financial history, digital footprint or security risks may prove critical to sustaining public confidence in Nigeria’s telecommunications and financial systems.
For millions of Nigerians, the issue is no longer simply about making calls. It is about protecting digital identities in an increasingly interconnected world.
“Banks and telecom operators need to build a more coordinated security architecture together,” he said, warning that isolated controls within each sector would continue to leave exploitable gaps.
He also noted that many subscribers, particularly Nigerians living abroad, are unaware that inactive phone numbers may eventually be recycled if they are not actively maintained. While line retention services are available, he stressed that subscribers must comply with renewal requirements to retain ownership of their numbers.
The subscriber’s experience illustrated one of the most immediate dangers associated with recycled numbers: privacy breaches.
Receiving another person’s banking alerts means being exposed to confidential information that should never reach an unintended recipient.
Depending on the type of notification, this could include transaction details, loan repayments, investment updates, account activities and other sensitive financial information.
Consumer advocates say such incidents expose weaknesses in the processes used by banks, fintech companies and other digital service providers to maintain accurate customer records.
In many instances, former users abandon phone numbers without updating the contact details linked to their financial and digital accounts. When those numbers are eventually reassigned, confidential communications may continue flowing to whoever becomes the new subscriber, creating privacy risks for both parties.
