Recycled phone numbers leaving users exposed to hacking, Which? warns
Mobile phone users could be at risk of hacking, nuisance calls and messages or having their phone cut off due to little-known rules around recycling of old phone numbers, Which? warns.
The consumer watchdog has uncovered that there are risks posed by existing phone numbers that get reused by other consumers – from social media and online accounts getting hacked to older people losing access to their emergency phone lifeline.
Which? has had reports of people being bombarded with calls and messages from debt collectors and even people trying to buy drugs from them.
The problem exists because many of the ‘new’ numbers given out by telecoms firms in the UK are recycled from previous owners. There is a fixed pool of 11-digit combinations that begin with an 07 prefix so mobile phone service providers must recycle mobile numbers to meet customer demand.
When Which? surveyed more than 15,000 Which? members, one in 10 (11%) said they had changed their mobile number within the past decade.
Of those who had changed their mobile number within the past decade, only half (50%) said they had updated their number with all relevant accounts and organisations. A quarter had only updated with some (but not all) of their accounts, while one in 10 (10%) admitted they had not updated their number anywhere.
Which? is concerned that accounts and online identities are in danger from hackers if people do not update the phone number they have registered with accounts and organisations – particularly where two-factor authentication (2FA) is being used. This could allow a stranger with access to the mobile number to log in to social media and online shopping accounts. As well as 2FA, there is a risk of the number’s current owner receiving texts with sensitive information – for example from a child’s school or a GP surgery.
A third of members told Which? they did not know that phone companies can reallocate landline and mobile phone numbers which are no longer in use. Worryingly, seven per cent had experienced problems caused by the deactivation or reallocation of a landline and/or mobile phone number. The problems ranged from a phone number being deactivated without the customer’s consent after a period of non-use, to receiving calls and/or messages intended for the number’s previous owner.
Problems can arise if people continue to try and reach the number’s previous owner or if they have been engaged in illegal activity. Scott McGready, director of cybersecurity firm Damn Good Security, told Which? there have been several recent cases of people who have acquired a new number and logged into WhatsApp, only to find the account is ‘already registered and being used to coordinate spam/scams’ seemingly by previous users of the number. He added that the app had started to crack down on the issue.
Mobile numbers are recycled when previous users have their number deactivated for “non-use”. To people who use their phone every day, being deactivated for low use is a very unlikely prospect and even the shortest timescale for losing a number (70 days of non-use, according to Ofcom) might look reasonable at first glance. However, some people do not use their mobile phones in this way, and instead keep them for emergencies only.
Which? reached out to 16 UK mobile providers and found deactivation policies varied enormously among the 12 that responded, ranging from three months (Lebara and 1p Mobile) to nine months (Voxi). Requirements varied, but customers generally needed to make a call, send a text, use data or add credit within that timeframe to avoid being cut off.
Says Lisa Barber, Which? Tech editor:
“Our research shows that recycled phone numbers can cause significant problems for both the previous owner of the number and the new recipient – from the risk of being hacked to losing an emergency phone line or receiving worrying unsolicited messages.
“Ofcom should aim to improve the way providers communicate that a number is at risk of deactivation and look into the issues that recycled numbers are causing consumers.”
