New mobile subscribers in Mexico face significant security risks as they inherit the digital identities, bank debts, and connectivity history of previous owners through recycled phone numbers, according to expansion.mx.
Acquiring a reused number means inheriting the banking activity and digital notifications of the former holder. For users like M. Rodríguez, this includes receiving messages intended for someone else.
Beyond simple inconvenience, these numbers may be linked to scams, organized crime, or active criminal investigations.
“The person who acquires a recycled number has a high probability of receiving calls and messages or notifications from the previous holder,” the CEO of Silikn warned, as reported by expansion.mx.
Furthermore, some of these numbers might be present in databases used by cybercriminals, which increases the frequency of scam calls.
Regulatory gaps and privacy risks
Current guidelines for registering telephone lines via the CURP (Unique Population Registry Code) do not include specific mechanisms to manage recycled numbers or prevent future problems for users.
When expansion.mx requested information from the CRT regarding whether they would implement mechanisms to mitigate these risks, the agency did not comment.
Currently, telecommunications companies do not notify users if a number is new or recycled. This lack of transparency prevents customers from knowing they might be receiving communications meant for a previous owner.
“Companies should avoid recycling numbers and try to launch new lines,” said Víctor Ruiz.
He added that if notification is not possible because it creates privacy issues for both parties, the new holder ends up with an endless stream of messages while the old holder's privacy is exposed.
Data from the United States highlights the scale of this issue. A study titled “The right to be forgotten in the context of mobile number recycling” found that 83% of 259 lines from two major operators were recycled.
Of those, 66% were linked to existing online accounts or personally identifiable information. Additionally, 39% were tied to compromised passwords, allowing cybercriminals to bypass two-factor authentication.
“Almost 10% of people with a recycled number received confidential calls or text messages within one week, including one-time access codes from major platforms and personal data such as medical or banking information,” the study detailed.
