Imagine losing access to your mobile line, only to discover later that someone else is using your old number and receiving sensitive messages or even accessing your bank account. This scenario is not far-fetched in Nigeria. SIM card recycling, the practice of reassigning inactive phone numbers to new subscribers, has become common among Nigerian telecom providers. With phone numbers now serving as gateways to vital services (from banking via USSD codes to one-time passwords for social media), a recycled number in the wrong hands can lead to identity theft and financial fraud. This article explores how Nigeria’s phone number recycling system works, why it exists, and the serious privacy and financial risks it poses to the general public.
Understanding SIM Recycling in Nigeria
SIM recycling means that if a phone number stays unused for long enough, the mobile network can deactivate it and later assign that same number to another customer. In Nigeria, telecom operators such as MTN, Glo, Airtel, and 9mobile are permitted (and even required) to recycle dormant numbers after a certain period of inactivity. According to guidelines from the Nigerian Communications Commission (NCC), a SIM card that has not engaged in any revenue-generating activity (no calls, texts, data use, or airtime recharge) for about 6 months may be deactivated.
If it remains inactive for an additional period (a few more months of dormancy), the number becomes eligible for churning, in other words, the number is recycled and can be reassigned to a new user. In practice, operators first suspend a SIM after months of no usage, then permanently deactivate and recycle it if no reactivation occurs within the stipulated window. Once a number is recycled and sold to a new customer, the original owner cannot reclaim it, the number effectively becomes someone else’s property.
This policy might sound harsh, but it is rooted in practical needs. Phone numbers are a finite resource. Globally, telephone numbers are managed under the ITU’s Recommendation E.164, an international numbering plan that ensures numbers are used efficiently and allocated fairly across countries. Each country (including Nigeria) has a limited pool of valid phone numbers of a fixed length. Nigerian mobile numbers are usually 11 digits (e.g. 0803xxxxxxx), meaning there are only so many combinations available. The NCC assigns blocks of these numbers to operators for use. To prevent wastage, regulators and operators don’t want numbers lying idle indefinitely. If a number isn’t being used, eventually it must be recycled to serve a new subscriber who needs a line.
In fact, Nigerian operators pay annual fees to the NCC for their allotted number ranges, so they have financial incentive not to let numbers sit dormant. In summary, operators do not “own” phone numbers, all numbers are resources owned by the government (managed by NCC) and essentially leased to operators, who then provide them to subscribers for use. If a subscriber stops using a number, the operator is within its rights (and obligations) to take it back and reassign it after the grace period, to keep the numbering system efficient and updated.
Why Telecom Operators Recycle Dormant Numbers
Several factors drive SIM recycling. First, there’s a need for accurate record-keeping and resource usage. The NCC wants to maintain an up-to-date count of active subscribers in the country. If millions of old lines remained assigned to people who aren’t actually using them, it would inflate subscription statistics and waste number ranges that could serve active users.
Pruning off dormant lines, operators can report a more realistic subscriber base and make available blocks of numbers for active use. For example, by mid-2016 Nigeria had a total of about 226 million connected telephone lines, but only roughly 150 million of those were in active use. This means tens of millions of numbers were inactive at that time a large pool that operators could reclaim and redistribute. Without recycling, new customers might have difficulty obtaining numbers, while old unused SIMs simply occupy number space for no benefit.
Secondly, as of 2022, Nigeria had about 222 million mobile cellular connections a number that actually exceeds the country’s population. (Many Nigerians own multiple SIM cards, often to take advantage of different networks or tariffs.) There is a practical limit to how many unique numbers can exist under the national numbering plan. Regulators must ensure that this limited pool is not exhausted. Recycling inactive lines frees up numbers so new customers can get connected without running out of combinations.
Finally, there are commercial reasons. Operators derive revenue from active lines (through calls, data, SMS, etc.). They do not earn anything from a SIM that stays idle for months. It makes business sense to deactivate lines that aren’t generating revenue and give those numbers to subscribers who will actually use (and pay for) services. The NCC’s Quality of Servicerules introduced in 2024 formalised this process by setting clear timelines for when inactivity should trigger deactivation and recycling, ensuring all operators follow a consistent practice. In essence, a phone number is “use it or lose it”, if you don’t use your line for an extended period, you risk having that number assigned to somebody else.
Regulatory Guidelines for Inactive SIMs
Under NCC regulations, if a SIM card goes unused for 6 months, no calls, SMS, data, or recharge, it may be flagged as dormant and deactivated. At this stage, the subscriber can still recover the number by reactivating it. However, if inactivity continues for a few more months (typically 9 to 12 months total), the number becomes eligible for recycling. After a brief quarantine period, it can be reassigned to a new user.
An exception applies if inactivity is due to network issues; in such cases, that period isn’t counted against the user. But generally, once a number is recycled, the original owner loses all rights to it.
Phone numbers are public resources, not personal property, and must be actively used to retain them. This aligns with global practice, as numbers are finite. Telecom operators typically send warnings before deactivation, but if ignored, recycling proceeds as required.
Risks of SIM Recycling: Identity Theft and Fraud
While number recycling has practical benefits, it unfortunately carries serious risks for consumers. The most alarming issue is that phone numbers today are tied to personal identity and security in ways that were not originally intended. Over the past decade, Nigeria has implemented initiatives like the Bank Verification Number (BVN) for banking and the National Identity Number (NIN) for general identification, and in many cases your phone number is linked to these systems. Banks and fintech services use your registered phone number as a primary means to authenticate customers – for example, through USSD codes and SMS-based two-factor authentication (2FA). Likewise, online services (email providers, social media, messaging apps like WhatsApp, etc.) often use your phone number to verify accounts or send password reset codes. This means if someone else gets control of your phone number, they could potentially impersonate you or bypass security measures on your accounts.
When a dormant number is recycled, the new owner might start receiving calls and texts meant for the previous owner. In innocent cases, this is just a nuisance (wrong-number calls or messages from contacts unaware of the change). But in worst-case scenarios, those messages could include sensitive data, for instance, an SMS from your bank with a one-time PIN, or a two-factor authentication code to access your email. If you failed to update your records and the new SIM holder is unscrupulous, they could use that information to breach your accounts.
In Nigeria, a particularly worrying vector is USSD banking. USSD shortcodes (like dialing *XXX# to transfer funds or check balances) are linked to your phone number and bank account. If your phone number was linked to your bank account and you abandon the SIM, a new person who acquires that number could potentially dial the bank’s USSD code and attempt transactions on your account. In many cases, USSD services require a PIN but if the PIN is weak, or if the new user manages to reset it (sometimes banks allow PIN reset via the same number), they might gain access to the account. There have been reports in Nigeria of fraudsters exploiting recycled SIMs to steal money. In one such case, a Lagos resident lost significant funds when her old mobile line, which she had linked to her bank – was reassigned; the new user initiated unauthorised transfers via USSD, since the phone number was still recognized by the bank’s system as the account’s contact. This kind of crime can happen quickly and often without the original owner’s knowledge until the damage is done.
Even beyond bank accounts, think about other implications: your email, social media, and messaging apps. If you secured these with SMS-based verification, a recycled number puts them at risk. For example, if you registered WhatsApp with that phone number, the new owner could install WhatsApp and receive the verification SMS, effectively taking over your WhatsApp account (if you hadn’t updated the number on the account). Similar threats exist for Telegram, Facebook, Twitter, and any service where your old phone number is an account recovery method.
Essentially, the new person inherits a piece of your digital identity. Unless you proactively changed your phone number on all those services before or shortly after losing the number, you remain vulnerable.
The privacy implications are huge as well. The new holder might start getting your personal calls (e.g. a doctor’s office calling for an appointment reminder) or seeing your messages. In Nigeria, where phone numbers are used for so many aspects of daily life (from receiving OTPs to utility bill alerts), the leak of personal information via a recycled SIM can be devastating. Unfortunately, many users do not realize this risk.
If a SIM card gets lost, damaged, or they simply stop using it (perhaps they traveled or switched networks), they might not immediately notify all their banks and online accounts. They might assume their inactivity just means the line goes quiet – not realizing it will eventually be activated in someone else’s phone.
However, even without insider tricks, just possessing the working SIM may be enough if service providers don’t have secondary verification. For example, some Nigerian banks will send an OTP to the phone number and allow transactions if that OTP is confirmed – not realizing the number is now in new hands. This is essentially an identity theft loophole created by the recycling practice.
It’s worth noting that this problem isn’t unique to Nigeria around the world, there have been many cases of account takeovers due to phone number recycling. Researchers have found that a significant portion of recycled mobile numbers still receive sensitive communications tied to the previous owners.
The difference is that in Nigeria the stakes are higher in some respects, because of how tightly integrated phone numbers have become with official identity (NIN linking) and essential services. When SIM registration was first introduced in Nigeria (around 2010–2011), it was intended simply to have a name attached to each number for security reasons not to serve as a universal ID system. Now, however, that same SIM registration (with NIN linkage) means your phone number is effectively an extension of your identity. The downside is that if your number falls into someone else’s hands, it’s almost as if a part of your identity has been handed over to a stranger.
Can the Risks Be Mitigated?
The growing awareness of SIM recycling dangers has led to calls for stronger safeguards. Critics argue that the NCC needs to enforce better oversight of how recycled numbers are handled to protect consumers. For instance, there is currently no requirement for operators to notify the previous owner (if reachable) that their old number has been reassigned. Once your SIM is deactivated, you might not get any official notice that “your number is now gone.” A notification system (perhaps via email or alternative contact method on file) could at least alert people to update their records elsewhere.
Another suggestion is a longer quarantine period before a number is recycled for example, keeping a number inactive for 6 extra months (with no new owner) before recycling, and during that period blocking any security-critical messages (like bank OTPs) from going through. This could reduce the chance of immediate fraud. Some countries implement short quarantine periods to let any stray messages die out, but it’s unclear if Nigerian operators do this or how long their quarantine lasts.
Banks and other service providers also have a role to play. They could implement checks such as notifying the customer’s email on file when a phone number linked to the account is changed or when transactions are initiated on a new device/number combination. If a bank detects that a number recently became active on a different SIM card (something they might infer if, say, the SIM IMSI or other network identifiers change), they could require additional verification.
Customers, on their part, should immediately report lost SIMs and get replacements (or formally close the line with the provider) rather than just abandoning a line. If you no longer wish to use a number, the safer approach is to proactively unlink it from all your important accounts (banks, emails, NIN, etc.) before it goes dead. Unfortunately, many people only realize this in hindsight, after suffering a loss.
On the regulatory front, the NCC may need to update SIM registration frameworks to account for this new usage. Originally, SIM registration was not intended as a comprehensive identity system, but now that it effectively is one, the policies around SIM management have privacy implications. Data protection laws could be interpreted to cover scenarios of personal data exposure via recycled numbers. For example, if your medical information was sent via SMS to your number, and then that number was reassigned and the new person saw that info, is there a breach of confidentiality? These are questions that regulators and lawmakers might need to address as the digital identity ecosystem matures.
