Your phone number
is not yours.
The recycling crisis nobody warned you about.

I got a new SIM card this week. Within minutes of activating it, I discovered the number had a history — a WhatsApp Business account that had been permanently banned, and an active Telegram 2FA prompt for a login that was not mine. Someone else's account. Someone else's email address. Live, on a number I had just been handed as "new."

This was not a hack. Nobody broke in. The previous owner of that number simply stopped loading airtime. The network recycled it. And without any warning, any cooling-off period worth the name, or any mechanism to clean the number's digital footprint before reassignment, it landed in my hands still carrying everything its previous owner had attached to it.

My father's experience was different but equally alarming. He uses WiFi for most of his communication — WhatsApp over data, calls over WiFi, no SMS habit. He does not load airtime frequently because he does not need to. One day he simply found that the number was gone. No appeal. No notice that he could act on in time. A number he had used for years, linked to his bank accounts, his email recovery, his contacts — quietly decommissioned and scheduled for reassignment to a stranger.

These are not edge cases. They are two instances of a systemic practice that South African networks have been running quietly for years, that ICASA only just moved to address in July 2026, and that carries security implications so serious that Princeton University dedicated an entire study to documenting them.

How the recycling works — and how fast

Every South African mobile network recycles prepaid numbers. The timelines vary, but none of them are generous:

Until this month, there was no standardised process. Networks could — and did — recycle numbers with minimal notice, inconsistent quarantine periods, and no obligation to clean the number's associations before handing it to a new subscriber. The previous owner might not know until they tried to make a call and found their SIM dead.

Inactivity as defined by the operators means no revenue-generating activity — no voice calls, no SMS, no data, no airtime top-up. Under this definition, a person who uses their phone exclusively over WiFi (calls via WhatsApp, no SMS habit, no airtime reload) is classified as inactive even if they are using the number every day. That is exactly what happened to my father. He was not inactive. He was just not generating revenue for Vodacom in the specific ways Vodacom chose to define as "activity."

What the new ICASA regulations actually say

On July 1, 2026 — this month — ICASA published the Numbering Plan Fourth Amendment Regulations, finally creating a standardised national framework. The headline numbers sound like progress:

Operators must notify subscribers after 60 consecutive days of inactivity, then allow a 30-day grace period. After 90 days total, the number can be deactivated. After deactivation, it must be quarantined for one month before reassignment.

Subscribers who know they will be inactive — for example, travelling — can apply for an exemption valid for 183 days, at no cost.

On paper, this is better than what existed before. But the detail reveals how much remains unresolved.

Vodacom pushed for the quarantine to be cut to seven days. ICASA rejected this. MTN asked for three months to implement the new system. ICASA gave everyone six months. The rules take full practical effect around January 2027.

Until then, the old rules still apply in practice. And even after January 2027, the fundamental security problem — that recycled numbers inherit active digital associations — remains unaddressed.

The Princeton study: what the research actually found

In 2020 and 2021, researchers from Princeton University's Department of Computer Science and Center for Information Technology Policy published a landmark study: Security and Privacy Risks of Number Recycling at Mobile Carriers in the United States.

They examined 259 phone numbers available for new subscribers at two major US carriers. The findings should be on the front page of every newspaper in South Africa right now.

Two-thirds of recycled numbers — still linked to accounts. Not cleared. Not notified. Still pointing to the previous owner's email, banking profile, and social media. The person who receives that number receives those links with it.

The Princeton researchers identified five specific attack categories enabled by number recycling. Every single one of them is possible with South African numbers right now:

Direct account takeover. The new owner receives the previous owner's 2FA SMS codes. With a leaked password — freely available on data breach markets — they can log into the account without even triggering a "forgot password" flow. The researchers found 100 numbers linked to email addresses that had already appeared in password breaches on HaveIBeenPwned.

Targeted takeover. An attacker who knows someone has lost their number can monitor the recycling pool and deliberately acquire that specific number. Once obtained, every SMS-based account recovery goes to them.

Smishing. A new subscriber receiving texts intended for the previous owner is more likely to trust them. The texts arrive in context — from banks, from services the previous owner used. A malicious new owner can use this to complete social engineering attacks.

Mass exploitation. Attackers can purchase blocks of recycled numbers, test each one programmatically for live account associations, and conduct bulk account takeovers. This is not theoretical. The Consumer Financial Protection Bureau in the US observed a 35% increase in credit fraud cases tied to recycled numbers.

Doubly insecure configuration. The term coined in the Princeton study for accounts that use SMS both for 2FA login and for account recovery — meaning a recycled number provides complete account control, no password required.

Professor Arvind Narayanan of Princeton, one of the study's authors, stated the recommendation plainly: "If you need to give up your number, unlink it from online services first. Consider low-cost number 'parking' services. Use more secure alternatives to SMS-2FA such as authenticator apps."

The problem, of course, is that most people do not give up their number voluntarily. It is taken from them — as it was taken from my father — with minimal warning and no practical time to unlink anything.

The POPIA dimension

South Africa's Protection of Personal Information Act is explicit: personal information may only be processed with the knowledge and consent of the data subject, must be kept secure, and must not be retained longer than necessary. The Information Regulator, led by Advocate Pansy Tlakula, has enforcement powers including administrative fines of up to R10 million.

Number recycling, as currently practised, sits in uncomfortable tension with several POPIA principles simultaneously.

When a number is recycled and a new subscriber begins receiving OTP messages, banking alerts, and 2FA codes intended for the previous owner, that is personal information being processed by an unauthorised party. The previous owner did not consent to their bank communications being routed to a stranger. The new owner did not consent to processing the previous owner's personal information. The bank did not know the number had changed hands.

The RICA Act compounds this. Every SIM card in South Africa must be RICA-registered — linked to a verified identity document and address. When a number is recycled, the new owner RICA-registers it to themselves. But the digital ecosystem — every platform that authenticated using that number — still associates it with the previous owner's RICA-verified identity. Two people, one RICA'd number, no resolution mechanism.

The business model problem — and a solution

The networks are not recycling numbers out of malice. They are recycling them because phone numbers are a finite national resource — ICASA allocates them, and networks are legally obligated to use their allocation efficiently. The pressure to recycle comes partly from regulation, not despite it.

But the underlying tension is real and worth naming: the networks built their revenue models on voice calls and SMS. WhatsApp, iMessage, Signal, WiFi calling, and data-first communication have made those models increasingly irrelevant. A prepaid subscriber who uses their number entirely over data — never making a call, never sending an SMS, never loading airtime — generates close to zero revenue for the operator by traditional metrics. So the operator flags the number as inactive and recycles it.

The subscriber, meanwhile, is active every day. Their number is essential infrastructure — linked to their bank, their employer's HR system, their children's school, their doctor's patient portal, their pension fund. The operator's definition of "inactive" does not map to reality in any meaningful sense.

There is a straightforward solution that does not require regulatory intervention, does not deprive operators of revenue, and does not require users to change their behaviour: a SIM retention fee.

A nominal monthly charge — R10 per SIM is a reasonable starting point — for maintaining number reservation independently of usage. This serves everyone:

• Subscribers who use WiFi exclusively retain their number without having to "prove" activity by loading airtime they do not need
• Operators generate a small but meaningful revenue stream from the millions of SIMs that currently generate nothing
• The number pool remains available for genuinely abandoned numbers while protecting active-but-data-first users
• The digital security risk from recycled numbers is dramatically reduced because fewer numbers cycle through the recycling pool

MTN and FNB Connect argued to ICASA during the July 2026 consultation that operators should be permitted to charge a nominal retention fee for the exemption process. ICASA declined — but notably, it did so partly because operators had already argued for longer inactivity periods, suggesting the cost of retaining a dormant number is small. A small recurring fee would resolve that ambiguity entirely and provide a sustainable model for number reservation.

What you can do right now

The regulatory fix is coming — but slowly. ICASA's new rules give operators until January 2027 to implement, and even then the one-month quarantine does not solve the underlying security problem. Here is what you can do today to protect yourself and your family:

What we need from operators — and from ICASA

The July 2026 regulations are a start. They are not enough. These are the specific changes that would address the actual security risk rather than just the notification gap:

Mandatory platform notification. Before a number is reassigned, operators should be required to notify major platforms — WhatsApp, Telegram, the major banks, Google, Apple — that the number is changing hands. The technical infrastructure to do this exists. Telesign and similar services already provide real-time number deactivation signals to businesses that pay for them. Make it mandatory and standardised.

A meaningful quarantine period. Thirty days is not enough to clear a number's digital associations. Six months — matching the exemption period ICASA already uses — would give previous owners time to discover their number is gone and update their accounts.

A SIM retention product. A nominal monthly fee — R10 is reasonable — for number reservation regardless of usage activity. This serves WiFi-first users, travellers, and anyone whose usage pattern does not fit the voice-and-SMS revenue model the operators built their inactivity definitions around.

POPIA enforcement. The Information Regulator should issue formal guidance on whether the current recycling practice, and specifically the transfer of OTP routing and 2FA associations to unauthorised parties, constitutes a POPIA violation. The Act is clear on data security and purpose limitation. Number recycling without adequate clearing measures appears to breach both.

The house analogy

When you buy a house in South Africa, the seller is legally required to disclose known defects, existing encumbrances, and any third-party claims on the property. You do not buy a house and discover three months later that the previous owner's creditors have a claim on the garage. The law protects you.

A phone number in 2026 is infrastructure in the same way a house is infrastructure. It is tied to your financial accounts, your legal identity through RICA, your employment records, your medical history, your children's schools. The person who gets your recycled number does not just get a string of digits. They get a key to a house that was never properly decommissioned before it was handed to them.

The buyer of that house — the new subscriber — has no way to know what doors that key opens. And the previous owner does not know they have lost their key until they try to open a door and find it does not work anymore.

The networks built a system that serves their operational needs and their legal obligation to use numbering resources efficiently. They did not build a system that protects the people whose identities are attached to those numbers. ICASA's July 2026 regulations begin to address the notification gap. They do not address the security gap.

Until they do, the most important thing any South African can do is treat their phone number as temporary, fragile infrastructure — not permanent identity. Because as of today, that is exactly what it is.