Why a phone number is the worst identity key you own
Your email address is portable and yours. Your password can be rotated in a minute. Your phone number is neither: it is leased from a carrier, in one country, under a contract that can end without your involvement — and yet it has quietly become the master key to more of your life than either of the other two.
The awkward part is that nobody chose this. Services added SMS verification because it was cheap and universal, then started accepting the same number as proof of identity for password resets. Over a decade, a rented identifier became the thing that unlocks your bank.
Numbers slip away for boring reasons, not dramatic ones:
- You move country. Keeping a foreign line alive costs money and often needs a local address you no longer have.
- You switch carrier and the port fails, or you never asked for one because a new number was simpler.
- A prepaid line lapses. Many are reclaimed after a few months without a paid top-up, even if the balance is still there.
- The line was never yours: an employer's plan, a family bundle, a partner's account. Leaving ends the number.
Then the number is recycled. Carriers reissue disconnected numbers to new subscribers after an ageing period measured in weeks or months, which means a stranger eventually receives the password-reset codes for whatever you forgot to move.
| Feature | Do nothing and take a new number | Port the old number to a new carrier | Move your codes to a line you keep |
|---|---|---|---|
| Accounts you must update by hand | All of them | None, the number follows you | All of them, once |
| Works when you move country | Yes, with a new local number | Rarely — porting stops at the border | Yes, the line does not move |
| Works when the line was your employer's | Yes, by starting over | Sometimes, and only with their consent | Yes |
| Old number recycled to a stranger | Yes, after the ageing period | No | Not while the line is paid |
| Cost | Free | Usually free, carrier fees vary | From $3.58/month |
| How long it takes | Weeks of small surprises | A few days if it works at all | Under 60 seconds to open the line |
| Protects the next change too | No, it repeats every time | No, only this once | Yes, there is no next change |
| Identity required | Carrier registration | Carrier registration on both sides | None, crypto-only billing |
| What it does not solve | Nothing is solved, only postponed | A carrier can still close the account | Banks that demand a carrier line |
What breaks when the number changes, and in what order
Nothing announces itself. You will not get an email saying "your bank can no longer reach you" — you will simply find out at the worst moment, when a transfer needs confirming or a login asks for a code that never arrives.
In rough order of how badly it hurts:
- Accounts with SMS as the only second factor. The login is now impossible, not merely inconvenient.
- Accounts using the number for recovery, even when you log in with an authenticator app. This is the one people miss, because everything works until the day you need to recover.
- "Sign in with phone" accounts that never had a password at all — some delivery, ride-hailing and marketplace apps.
- Banks and exchanges, which often need an in-person or documented identity check to change the number on file, and which may block transfers in the meantime.
- Messengers. WhatsApp, Telegram and Signal are tied to the number; if you re-register from a new one without migrating, you appear to your contacts as a new person and lose group membership.
- Everyone who has your old number in their phone, including the people who will now reach a stranger.
The recycled-number problem cuts both ways. A guide to SIM swap attacks covers what happens when someone takes your number deliberately; this is the same exposure created accidentally, by you, for free.
The five-minute audit: find every account that depends on your number
You cannot migrate a list you do not have, and nobody remembers all of it. Four searches recover most of it in a few minutes:
- Search your mailbox for verification code, one-time code, security alert and phone number. Every service that ever texted you also emailed you at some point.
- Open your password manager and filter for entries with a phone field or a note about SMS. Most managers can list them.
- Scroll your SMS history before you lose the line. The senders are the inventory.
- List the ten accounts that would hurt most — mailbox, password manager, bank, exchange, cloud backup, domain registrar, work SSO, the two messengers you actually use, and whatever holds your photos.
Then do the thing almost nobody does: for each of those ten, open security settings and note whether the number is used for login, for recovery, or for both. The recovery column is where the lockouts come from. While you are in there, export or print the backup codes — they are the only thing that works when the line is gone.
The migration checklist, in the order that matters
Order is not cosmetic here. Each step unlocks the next, and doing them backwards is how people end up locked out of the mailbox they needed in order to fix everything else. If you can, arrange an overlap — keep the old line active for 30 to 60 days after the new one starts. It is cheap and it turns a migration into an errand rather than an emergency.
- Primary mailbox first. Change the number for both login and recovery, confirm on the new line, and re-download fresh backup codes.
- Password manager next, then re-check that its recovery path no longer points at the old number.
- Banks, brokers and any crypto exchange. These are the slowest — some need a branch visit or a document upload, and a few impose a cooling-off period on withdrawals after a number change. Start them early.
- Messengers, from inside the app. WhatsApp, Telegram and Signal all have a change-number function that keeps your account, your chats and your groups and tells your contacts. Re-registering from scratch on a new number does none of that.
- Government, health and tax portals, which frequently have the slowest and most bureaucratic change process of all.
- Everything else: delivery, ride-hailing, loyalty, airlines, insurance, the utilities that send an SMS when an engineer is on the way.
- Only now let the old line go — and only after a full billing cycle has passed with nothing arriving on it that mattered.
If you are moving abroad rather than merely switching carrier, our guide on keeping a local number while you travel covers the second half of the problem: staying reachable at the old country code once you live somewhere else.
When the number is already gone: what is still recoverable
If you are reading this after the fact, the rule is simple: do not sign out of anything. A session that is still logged in is the most valuable asset you have, and closing it is irreversible.
Work outwards from what still works:
- Devices still signed in. From any of them, go straight to security settings and replace the phone number and recovery address before doing anything else.
- Backup codes. If you saved them, this is over in two minutes. If you did not, save them everywhere as soon as you regain access.
- Authenticator apps. Codes are generated on the device, not sent to the line, so an account with a working authenticator is unaffected by a dead number — see receiving one-time codes online.
- Recovery email. Many services fall back to it automatically once the SMS attempt fails.
- Account recovery forms. Slow and unglamorous, typically a waiting period of several days, and they succeed far more often when you can answer from a device and location the service has seen before.
- Documented identity checks at banks and regulated brokers — usually the only route, and the reason to start them the moment you notice.
Be honest about the tail. An account with SMS-only two-factor, no recovery email, no backup codes and no identity on file is often simply lost. That is a design failure of the service, not a mistake you made, but the outcome is the same.
Stop it happening again: separate the line from the carrier and the country
Every cause in the first section has the same shape: the number belongs to a carrier, a contract, a country or an employer, and when that relationship ends the number ends with it. The structural fix is to stop routing your codes through a line that any of those parties can cancel.
A dedicated line held in your own name, outside the carrier relationship, changes what a house move or a job change costs you:
- It survives moving country. The line lives in the browser, so it does not care which SIM is in your handset or which passport is in your pocket.
- It survives changing carrier, changing handset, and losing a handset — there is no SIM to swap and nothing to port.
- It is not recycled while you pay for it, unlike a prepaid line that lapses quietly after a few months of silence.
- It is not your employer's. Nobody can end it as part of ending something else.
- Real, dialable lines in 47 countries — mobile ranges that banks and messengers accept, not the throwaway VoIP ranges most services reject.
The limits are real too. You have to keep the account and the payments alive, exactly as you would a SIM. A few banks still insist on a carrier line registered to your legal identity, and no second number helps there. And it only pays off once you have actually moved the accounts onto it — which is the checklist above, done once, deliberately, instead of in a panic. Lines start at $3.58/month and activate in under 60 seconds. If you are weighing this against a disposable number, long-term lines versus burners is the direct comparison.
Key facts
- A phone number is leased, not owned: the carrier can reclaim it, and the country and the contract come with it.
- Disconnected numbers are recycled to a new subscriber after a few weeks to a few months, depending on the country.
- The account that matters most is your primary mailbox — it can reset almost everything else, so it moves first.
- Keeping the old line alive for 30–60 days alongside the new one is the single biggest predictor of a painless migration.
- Authenticator codes and passkeys survive a number change; SMS codes and "sign in with phone" accounts do not.
- Messengers migrate properly only if you change the number inside the app, before the old line dies.
- A number that is not tied to a carrier, a country or an employer does not have to be changed at all.