Recycled phone numbers leaving mobile phone users exposed to hacking, nuisance calls, or being cut off, Which? warns
The consumer champion has uncovered that there are risks posed by existing phone numbers that get reused by other consumers – from social media and online accounts getting hacked to older people losing access to their emergency phone lifeline.
Which? has had reports of people being bombarded with calls and messages from debt collectors and even people trying to buy drugs from them.
The problem exists because many of the ‘new’ numbers given out by telecoms firms in the UK are recycled from previous owners. There is a fixed pool of 11-digit combinations that begin with an 07 prefix so mobile phone service providers must recycle mobile numbers to meet customer demand.
When Which? surveyed more than 15,000 Which? members, one in 10 (11%) said they had changed their mobile number within the past decade.
Of those who had changed their mobile number within the past decade, only half (50%) said they had updated their number with all relevant accounts and organisations. A quarter had only updated with some (but not all) of their accounts, while one in 10 (10%) admitted they had not updated their number anywhere.
Which? is concerned that accounts and online identities are in danger from hackers if people do not update the phone number they have registered with accounts and organisations – particularly where two-factor authentication (2FA) is being used. This could allow a stranger with access to the mobile number to log in to social media and online shopping accounts. As well as 2FA, there is a risk of the number’s current owner receiving texts with sensitive information – for example from a child’s school or a GP surgery.
A third of members told Which? they did not know that phone companies can reallocate landline and mobile phone numbers which are no longer in use. Worryingly, seven per cent had experienced problems caused by the deactivation or reallocation of a landline and/or mobile phone number. The problems ranged from a phone number being deactivated without the customer’s consent after a period of non-use, to receiving calls and/or messages intended for the number’s previous owner.
Problems can arise if people continue to try and reach the number’s previous owner or if they have been engaged in illegal activity. Scott McGready, director of cybersecurity firm Damn Good Security, told Which? there have been several recent cases of people who have acquired a new number and logged into WhatsApp, only to find the account is ‘already registered and being used to coordinate spam/scams’ seemingly by previous users of the number. He added that the app had started to crack down on the issue.
Parents should also be wary when their child gets their first phone. Sarah (name has been changed) bought her two youngest children their first phones in 2023. Both children started receiving unwanted calls from unknown persons who were apparently trying to get hold of someone who had used their numbers before. One of the unwanted callers was “another teenager or young adult who was clearly a vulnerable person in care or in the social-work system, who had been skipping school”.
Sarah and her partner blocked all the offending numbers but were shocked to find the callers were still able to leave voicemails. She shared her surprise that there is “no current legal requirement or duty of care to ensure children receive ‘clean’ numbers”.
Mobile numbers are recycled when previous users have their number deactivated for “non-use”. To people who use their phone every day, being deactivated for low use is a very unlikely prospect and even the shortest timescale for losing a number (70 days of non-use, according to Ofcom) might look reasonable at first glance.
However, some people do not use their mobile phones in this way, and instead keep them for emergencies only. For example, people enduring domestic abuse may keep a ‘safe phone’ hidden away without their abuser’s knowledge and several people told Which? about older relatives who had been cut off without their consent due to infrequent use of their phone.
Which? reached out to 16 UK mobile providers and found deactivation policies varied enormously among the 12 that responded, ranging from three months (Lebara and 1p Mobile) to nine months (Voxi). Requirements varied, but customers generally needed to make a call, send a text, use data or add credit within that timeframe to avoid being cut off. It is sometimes possible to recover use of the number if it was only suspended recently.
A number of concerning areas emerged. For example, several networks told Which? they either do not warn customers they are about to be disconnected (Tesco Mobile), or warn them by texting the very numbers that are not in regular use (EE, Lyca Mobile, Vodafone and Voxi). Which? believes providers should also be using any other agreed contact methods listed on the customer's account to alert them.
Lisa Barber, Which? Tech editor, said:
“Our research shows that recycled phone numbers can cause significant problems for both the previous owner of the number and the new recipient – from the risk of being hacked to losing an emergency phone line or receiving worrying unsolicited messages.
“Ofcom should aim to improve the way providers communicate that a number is at risk of deactivation and look into the issues that recycled numbers are causing consumers.”
-ENDS-
Notes to editors
Which? surveyed 15,220 members of its online panel between 19th and 31st July 2024.
Link to Which?'s online news story which is embargoed until 00:01 on Friday 11th October: Phone number recycling investigation.
The full print article was published in Which? Tech magazine - October 2024 edition.
Extra case study information
Several Which? members recounted receiving calls and messages – in one case, for several years – that were clearly intended for their number’s previous owner. In two cases, the unwanted contact came from debt collection agencies, raising the prospect that people experiencing problem debt have changed numbers in order to evade their creditors.
One person even said that they had ‘received many calls and text messages on [their] new UK phone number from people looking to buy drugs in Loughborough.’ Another person told Which?: ‘I sometimes receive texts offering illegal drugs for sale.’
Extra details regarding numbers being cut off
Those on contracts were less vulnerable than pay-as-you-go (PAYG) customers to being cut off as their monthly payments generally counted as a form of usage.
Example of good practice
While most providers had buried their deactivation policies in the T&Cs, Giffgaff and EE both have easy-to-read help pages about this topic on their websites. Giffgaff also shared that it holds on to deactivated numbers for a year before reallocating them to another customer, while Three waits at least 18 months.
Advice for consumers on how to keep your number:
Given the potentially unwanted consequences of changing numbers,it makes sense to keep yours wherever possible. If you’re an infrequent PAYG user, make sure you know what your provider’s usage requirements are. Check its T&Cs or contact it to be sure.
Set yourself a reminder to call, text, use your data or top up at the necessary intervals to avoid being cut off. If this is difficult because of your particular circumstances, consider switching to a rock-bottom pay monthly deal (Which? Switch Mobile: Compare Mobile Phone Contracts), but it is also worth disclosing any vulnerabilities to your current provider in the first instance to see what help is available.
Changing provider
If you’re changing provider to seek better customer service or a money-saving deal, you can easily retain your existing number and move it over to your new provider. This is known as ‘porting’. To do this, you’ll need a unique number called a Port Authorisation Code (PAC), which you can request by texting ‘PAC’ to 65075. Your PAC will be texted back to you within two working days. Once you have a PAC, it’s valid for 30 days. If it expires, you can request a new one. Give the PAC to your new provider and it will notify your current provider of the port request. Your number is normally ready to use with your new services within one working day.
Spam/scam calls
If you’re troubled by scam or spam calls, there are things you can try before going through the upheaval of changing numbers. This includes blocking troublesome numbers, registering with the Telephone Preference Service and exploring an array of call-blocking options. For more tips and advice, see which.co.uk/stopcalls
About Which?
Which? is the UK’s consumer champion, here to make life simpler, fairer and safer for everyone. Our research gets to the heart of consumer issues, our advice is impartial, and our rigorous product tests lead to expert recommendations. We’re the independent consumer voice that influences politicians and lawmakers, investigates, holds businesses to account and makes change happen.
As an organisation we’re not for profit and all for making consumers more powerful. The information in this press release is for editorial use by journalists and media outlets only. Any business seeking to reproduce information in this release should contact the Which? Endorsement Scheme team at endorsementscheme@which.co.uk.