When a user switches mobile operators, their current number is usually transferred to the new provider. However, if this does not happen—for example, when signing a new contract with a different number, canceling a second SIM card, or when a prepaid card expires—the old number is returned to the operator and may later be assigned to another customer. In such cases, the previous number may still be listed in Google, PayPal, banking services, and other systems as a recovery method for account access.

Number Reassignment Procedure in Germany

In Germany, a phone number is returned to the operator immediately after the contract ends. There is no legally mandated minimum protection period for a number after contract termination. According to the Telekommunikations-Nummerierungsverordnung, the number reverts to the original holder (the operator) once the service ends. The waiting period before the number is reassigned depends on the operator’s policy and can range from one to six months. After this period, the number may be given to a new user, who could potentially gain access to the previous owner’s data and accounts. Some services, such as WhatsApp, consider a number potentially reassigned after just 45 days of inactivity, although account deletion occurs only after 120 days. In some cases, numbers can be reassigned as soon as 30 days after deactivation.

Comparison with the USA

In the USA, the FCC regulator sets a minimum waiting period of 45 days before a number can be reassigned, with a maximum of 90 days for private users. Germany does not have such requirements.

Reasons for Number Reassignment

There is no shortage of mobile numbers in Germany. According to Bundesnetzagentur, the country has around 430 blocks of one million numbers each, and by the end of 2025, there were 106.4 million SIM profiles in active use. Number reassignment occurs for operational reasons, not due to a lack of resources.

Security Research on Reassigned Numbers

Reliable data on the risks of number reassignment comes from a US study in which 259 available numbers were purchased from Verizon and T-Mobile. The study found that 66% of these numbers were linked to at least one account of a previous owner on services like Amazon, AOL, Facebook, Google, PayPal, and Yahoo. During a week-long observation of 200 reassigned numbers, 10% received messages related to security, including one-time codes from various services.

This study was conducted only in the USA and does not cover German operators. The actual risk may be higher, as the researchers did not analyze the content of the messages received.

SIM Swapping and Vulnerabilities

Another way to gain access to a number is through SIM swapping, where a fraudster transfers the number to a new SIM card by impersonating the owner. This requires matching basic information such as name, address, date of birth, and the number to be transferred—details often available from data leaks. Major German operators do not offer a dedicated service to block number transfers, and additional security measures like customer passwords or PUK codes are not always used.

SIM swapping is not widespread in Germany, and there has been no significant increase in such attacks in 2024. However, targeted attacks require minimal effort.

Risks for Two-Factor Authentication

Using a phone number as a second factor for authentication can create vulnerabilities: if the number is reassigned, an attacker could gain access to accounts via SMS codes. The German Federal Office for Information Security (BSI) notes that if account recovery is possible with just one factor, this is considered a critical vulnerability.

Security Recommendations

• Review all accounts linked to finances, personal data, or email, and remove any numbers you no longer own.
• Replace SMS as a second authentication factor with an authenticator app or passkey wherever possible, as these methods are tied to your device rather than your number.
• When giving up a number, first log out of all accounts, then cancel the number to avoid losing access and prevent others from receiving your codes.

These measures will help reduce the risks associated with the reassignment of mobile numbers and better protect your personal information.