Recycled phone numbers: how number providers can check a number before reissuing it

Before you reissue a recycled phone number, check three things. First, the quarantine period your country requires has passed. Second, the number is really disconnected: not live on your network and not ported to another one. Third, no app accounts are still registered on it. A number with a leftover WhatsApp, Telegram or Facebook account can deliver the previous holder's messages and login codes to the next holder. Hold that number longer, re-check it, or warn the new holder before you hand it over. In the US, also report each permanent disconnection to the FCC's Reassigned Numbers Database every month.

This guide is for operators, MVNOs, virtual-number resellers and anyone else who hands numbers to new users. It covers why old accounts survive on recycled numbers, the quarantine rules we could confirm from regulators' own documents, and a pre-reissue check you can run in bulk. Facts are as of 7 November 2026. This is general guidance, not legal advice.

What happens to a phone number when its owner leaves?

The number goes back into the provider's pool, waits, and then goes to someone new. Numbers are a limited national resource. Regulators expect providers to use their blocks efficiently, so disconnected numbers are reused rather than retired.

The cycle usually has four stages:

1. Inactivity or cancellation. The subscriber cancels, stops paying, or a prepaid line goes unused for the period the rules allow.
2. Notice and deactivation. Many countries require a warning before an inactive number is cut off.
3. Quarantine (called "aging" in the US, "latency" in Italy). The number can't be given to anyone for a minimum period.
4. Reissue. The number returns to the pool of available numbers and goes to the next customer.

Nothing in that cycle touches the accounts the previous holder created with the number. The operator closes the line. WhatsApp, Telegram, a bank app or a marketplace never hear about it.

Why do recycled numbers still carry old app accounts?

Because many apps identify the account by the phone number, and each app cleans up inactive accounts on its own schedule, if at all.

• WhatsApp says a recycled number is identified "when an account is unused for 45 days, then reactivated on a new mobile device". At that point it removes the old account data, such as the profile photo and About text (WhatsApp Help Center). The cleanup is triggered by the new holder's activation. Until then, the old account can still exist on the number.
• Telegram says plainly that "the phone number is the only way for us to identify a Telegram user at the moment" and that "whoever has the number, has the account". By default, an account is deleted only after its owner hasn't come online for 18 months, and users can change that period in Settings (Telegram FAQ). So a number that rested for three months can come back with a live Telegram account on it.
• Other services use the number for account recovery and login codes. A new holder who asks for a password reset can receive the code.

Researchers have measured the problem. In a 2021 study at Princeton, Kevin Lee and Arvind Narayanan sampled 259 numbers on offer to new subscribers at two major US carriers. They found that 171 of them were still tied to existing accounts at popular websites, "potentially allowing those accounts to be hijacked". When they took 200 recycled numbers and monitored them for one week, nearly 10% were still receiving security- or privacy-sensitive calls and texts meant for previous owners (Lee & Narayanan, 2021, draft of 3 May 2021). The study is US-only and from 2021, but the mechanism it describes still applies wherever apps use the number as the account key.

For a number provider, that is three risks at once:

• The previous holder's privacy and security. Their messages, groups and login codes can reach a stranger.
• The new holder's experience. They get someone else's messages and can't register cleanly. Some will blame you.
• Fraud on your inventory. For virtual-number resellers in particular, a number with a live account on it can be abused to take over that account. That is a reason to check before you resell, and to refuse any customer who wants numbers because they carry accounts.

How long do operators quarantine numbers?

These are the rules we could confirm from primary sources on 2026-11-07. Other countries set their own periods, and operators can usually wait longer than the minimum.

Compare those periods with the app timers above. A 45- to 120-day quarantine is shorter than Telegram's 18-month default. And WhatsApp's 45-day rule is triggered by the new holder's activation, not by the passing of time. The quarantine protects the network side. It doesn't clear the app side. That gap is what a pre-reissue check closes.

Our country guides have more detail for India, Italy and the United States.

What does the US Reassigned Numbers Database ask of number providers?

It asks them to report disconnections, so that callers can find out a number changed hands. Under 47 CFR 64.1200(l), a reporting carrier must keep the most recent date each of its numbers was permanently disconnected, and report it to the database administrator "on the 15th day of each month". A number is permanently disconnected when the subscriber has permanently given it up, or the provider has permanently reversed the assignment. A number ported to another provider doesn't count as disconnected (eCFR, 47 CFR 64.1200).

The callers' side is in paragraph (m). A caller who queries the database with the date it got consent, and gets the answer "no" (not disconnected since then), is protected if the number had in fact been reassigned. The database calls itself a safeguard "against the statutory damages that accompany inadvertently calling or texting a reassigned number" (RND). Our Reassigned Numbers Database guide explains the queries and pricing.

The database protects the next holder from callers who had consent from the previous holder. It does nothing about app accounts on the number. Report to it, and also run your own check before reissue.

How can a number provider check a number before reissuing it?

Run one bulk job on the batch of numbers that come out of quarantine, and decide per number. A workable flow:

1. Select only numbers due for reissue. That means numbers you hold the rights to and whose quarantine has ended. Don't check whole blocks or ranges: our anti-enumeration controls refuse long runs of consecutive numbers, and the check is only meaningful for numbers you're about to hand out anyway.
2. Confirm the network state with HLR. A live network status check should show the number as not reachable on your network. If it's reachable, something is wrong: the line wasn't fully deactivated, or the number was ported out and isn't yours to reissue. An MNP lookup answers the porting question on its own, more cheaply.
3. Check for leftover app accounts. In the same job, add the app checks that matter in your market, for example WhatsApp, Telegram, Facebook and Instagram. Each answer is registered, not registered or unknown.
4. Decide and record. Use the table below. Store the result as a flag on the number in your inventory, with checked_at, and don't link it to the previous subscriber's identity.
5. Delete what you don't need. Once the number is reissued or held, the per-app answers have done their job. Keep only the decision.

This is a hygiene check on your own inventory. It isn't proof that a number is "safe", it doesn't tell you who held the number, and it can't delete anyone's account. Apps also differ: an account that still shows as registered may be dormant and harmless, or still in use by its owner on a new number they forgot to update. A longer hold gives the previous holder time to move their accounts.

What does the job look like?

Here is a real estimate for that kind of job, made with our public sandbox key on 2026-11-07. The sandbox accepts only our test values, so it shows the shape of the answer, not real inventory:

curl https://api.mobilevalidate.com/v1/jobs/estimate \
  -H "Authorization: Bearer mv_test_publicSandboxn9ZgneuhR1B9CRfKG3fulym" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001", "+447700900002", "+447700900003", "+447700900006"],
       "checks": ["hlr", "whatsapp", "telegram", "facebook"], "max_age": 0}'

Response (abridged):

{
  "object": "estimate",
  "total": 4, "valid": 4, "invalid": 0, "duplicate": 0, "cached": 0,
  "checks": ["number.hlr", "whatsapp.registered", "telegram.registered", "facebook.registered"],
  "checks_total": 16,
  "max_cost": { "amount": "0", "currency": "USD" },
  "breakdown": [
    { "check": "number.hlr", "price_mode": "batch", "checks": 4,
      "unit_price": { "amount": "0.005", "currency": "USD" } },
    { "check": "whatsapp.registered", "price_mode": "realtime", "reason": "small_batch", "checks": 4,
      "unit_price": { "amount": "0.004", "currency": "USD" },
      "countries": ["GB"], "batch_minimum": 132 },
    { "check": "telegram.registered", "price_mode": "batch", "checks": 4,
      "unit_price": { "amount": "0.0003", "currency": "USD" } },
    { "check": "facebook.registered", "price_mode": "batch", "checks": 4,
      "unit_price": { "amount": "0.0001", "currency": "USD" } }
  ]
}

max_age: 0 forces fresh answers, which is what you want for numbers that just finished quarantine: a cached answer from before the quarantine would be misleading. max_cost is 0 because test keys are never billed. The small_batch line shows that the bulk WhatsApp price needs at least 132 numbers from the same country in one job. Four numbers fall back to the real-time price. A weekly batch of numbers leaving quarantine is usually well above that. Then create the job with the same body and a cost cap, and download one row per number. The bulk jobs docs cover the full flow, including webhooks.

What does it cost?

From our public catalog (GET /v1/services), read on 2026-11-07, bulk-job prices per 1,000 numbers:

A worked example with made-up volumes: 10,000 numbers leave quarantine this month. HLR plus WhatsApp, Telegram and Facebook checks cost at most 10,000 × (US$0.005 + 0.00025 + 0.0003 + 0.0001) = US$56.50, about half a US cent per number. Unknown, invalid and duplicate results are free, so the real cost is usually lower. If 800 numbers show a leftover account and you re-check them after a longer hold, the app checks alone cost at most 800 × US$0.00065 = US$0.52.

Which numbers should you not check?

The check is for your own inventory and your own subscribers. The limits are firm:

• Numbers you don't hold. Don't check numbers you have no rights to, and don't check ranges to see which numbers carry accounts. Our acceptable use policy forbids enumeration and checking accounts without specific authority. Requests that look like sequential ranges are rejected.
• Accounts on numbers you don't own. We don't support verifying, registering or taking over app accounts on numbers you don't own or don't hold for a subscriber. That includes "aged" numbers sold for their existing accounts, and bulk account creation on virtual numbers. An account check tells you an account exists. It must never be the reason a number is sold or used.
• Results as identity. A result never names a person. Don't combine it with your old subscriber records to work out what the previous holder used.

Our Terms (section 5, item 9) also require a lawful basis that covers each app check, and say that "mere possession of an Identifier" isn't enough on its own. A provider checking a number only to decide whether it's safe to reissue, without linking the result to a person, may be able to rely on legitimate interests or a similar basis, and many will add the check to their subscriber terms and privacy notice. Ask your counsel which basis fits in each country you operate in, and record it.

What should a new owner do if the number is already on WhatsApp?

If you hand out numbers, put this in your welcome message. It helps the new holder and protects the previous one:

1. Register the apps you use straight away. WhatsApp says to complete verification on your own device. That updates the account with your information and replaces the old profile. If the previous holder had two-step verification, you may have to wait a few days (WhatsApp Help Center).
2. Leave old groups and block unknown contacts. WhatsApp recommends exactly that after taking over a recycled number.
3. Don't read or use the previous holder's data. If an app logs you into an account that clearly isn't yours, log out and contact that app's support. Telegram, for example, links the account to whoever has the number.
4. Ignore codes and messages meant for someone else. Don't act on them, and tell the sender if you can.
5. Ask for a different number if sensitive messages keep arriving. A provider would rather swap a number than handle a complaint.

And for the holder who is leaving: tell them to move or delete their app accounts and update their number at banks and other services before they cancel. That one notice at exit prevents most of the problems above. Our post on account takeover after a phone number change covers the service side.

How do you start with MobileValidate?

The checks for a pre-reissue job are live network status (HLR), MNP lookup and the app checks, such as WhatsApp and Telegram. All of them run in bulk jobs, and you can run several checks on the same list in one job. Viber and Zalo checks are available in bulk jobs only.

• Build free. Get a free test key to build your integration against fixed test answers.
• Check real numbers free. Every live account can check 20 phone numbers and 10 e-mail addresses for real, free, on the dashboard's Try it page. Request access to open one; accounts are approved automatically.
• Estimate before you pay. The job estimate is free and shows the maximum cost, duplicates and invalid rows before anything is checked.
• Then prepay. Top-ups of US$100 or more get a 5% bonus, US$500 or more 8%, and US$2,000 or more 10%.

Results are kept for your account's retention setting, 30 days by default, and you can delete a job's results at any time. Anyone can exclude their own number through our opt-out form. App names are used descriptively; MobileValidate is not affiliated with WhatsApp, Telegram or Meta.

What are the key takeaways?

• Operators recycle numbers after a quarantine: 45 to 90 days for US residential numbers, at least 90 days for Indian mobiles, three months in Italy, and a cycle of about 120 days under South Africa's new rules.
• App accounts outlive the quarantine. WhatsApp clears an old profile only when a new holder activates the number after 45 days of disuse, and Telegram's default inactivity deletion is 18 months.
• In a 2021 study, 171 of 259 US numbers on offer to new subscribers were still tied to accounts at popular websites.
• Before reissuing a number, check it with HLR (not live, not ported) and the app checks that matter in your market. Hold numbers that still carry accounts, or warn the new holder.
• Check only numbers you hold, with a recorded lawful basis, never ranges, and never to find or use accounts on numbers you don't own.