You replace a lost SIM card with a different number, abandon a second line or move abroad. Months later, someone else receives your old number. But your bank, email provider and other services may still have it on their records.
That is the problem behind Kenya’s push for stronger safeguards around recycled phone numbers: changing the person using a number does not necessarily update every account connected to it.
The Communications Authority of Kenya (CA) has published safeguards and consultation findings addressing that gap, including plans for a central database of reassigned numbers.
What is a recycled phone number?
A recycled number is a previously used telephone number reassigned to another subscriber after the earlier service ends.
The CA explains that numbers are finite resources. Subscribers receive the right to use them rather than permanent ownership, making recycling part of managing available numbers.
For the new subscriber, the number is new. For organisations still holding the previous user’s details, it may remain connected to an entirely different person.
Can the new owner receive your bank alerts or verification codes?
They could receive future messages if a service continues sending them to your old number. Whether that creates access to an account depends on the service’s authentication and recovery controls.
Consider a bank customer who changes numbers but leaves the old one registered for alerts. If that number is reassigned, a later message could reach the new subscriber.
The CA’s consultation findings explicitly address the need for banks, SACCOs and financial technology providers to establish whether numbers have changed hands before relying on them for verification or account recovery.
Receiving a message is not the same as automatically gaining access to someone’s bank account. But sending sensitive information to the wrong person creates a privacy risk even where additional security prevents a login.
What happens to WhatsApp?
WhatsApp acknowledges that a newly acquired number may previously have been registered on its service.
However, receiving that number does not automatically deliver the previous subscriber’s old conversations. WhatsApp explains that someone accessing an account on another device cannot read past conversations simply through that access, because messages are stored on users’ devices and protected by end-to-end encryption.
The practical concern is future communication: people who still associate the number with its former user may continue trying to contact them.
Anyone permanently changing numbers should update their messaging account rather than leave it tied to a line they no longer control.
How long before an inactive number can be recycled?
The CA’s published safeguards describe three months of inactivity followed by an additional three-month notification period, unless the subscriber resumes qualifying activity.
In its consultation response, the regulator explains this as a total six-month process. It also clarifies that mobile-money use counts among the value-added services considered when assessing activity.
Safaricom’s published prepaid terms separately refer to account expiry after 120 days of inactivity and reserve the right to deactivate and recycle a number afterwards. These contractual terms should be read alongside the regulator’s safeguards; customers should ask their operator about the status of a particular line rather than assume a guaranteed recycling date.
What protection is Kenya putting in place?
The CA document requires operators to separate and securely archive the previous subscriber’s personal data and associated services before a number is reassigned.
It also provides for a central system through which third parties can update their records, and for removing previous business-message subscriptions before recycling.
Although the document remains linked from a consultation page, it specifies September 19, 2026 as its implementation date. Requirements dependent on the central database take effect once that database is established. The documents reviewed do not establish that the database is already operational.
What to do before giving up a number
Treat changing a number as an account-security task. Before losing access:
- Update your banking, SACCO, insurance and other financial-service records.
- Replace the number in email and social-media recovery settings.
- Review services that send login or verification codes by SMS.
- Tell important personal and business contacts.
- Where supported, set up an authenticator app or another recovery method you control.
Making changes while the old line still works allows you to receive any verification messages needed to approve them. Australia’s communications regulator recommends the same precaution in its consumer guidance on recycled numbers.
What if your new number receives someone else’s messages?
Do not use unexpected verification codes to enter unfamiliar accounts. Contact the organisation through its official channels and explain that the number has been reassigned.
For persistent unwanted messages or registration problems, ask your operator for assistance. Unsubscribing from marketing alone may stop advertisements without removing the number from the former customer’s account.
For anyone abandoning a line, the essential question is therefore bigger than whether the SIM card still works: which services still believe that number belongs to you?
