Your old Kenyan phone number could remain connected to your digital life long after you stop using the SIM card.
It might still be registered with your bank, linked to your M-PESA account, used to recover your email password or connected to your WhatsApp account. If a mobile operator eventually assigns that number to someone else, outdated records across these services can create privacy and account-security risks.
Kenya is now considering additional safeguards to address this problem. The Communications Authority of Kenya (CA) has proposed a central database of deactivated and recycled mobile numbers to help banks, fintech companies and other service providers identify numbers that have changed ownership.
The proposal comes amid wider scrutiny of how telecommunications operators deactivate inactive SIM cards and reassign their numbers.
For Kenyan consumers, the issue raises an important question: what happens to your digital accounts when you stop using a phone number?
This guide explains how number recycling works, the risks it can create, the difference between recycled numbers and SIM-swap fraud, and the practical steps you can take to protect your accounts.
What are recycled phone numbers?
A recycled phone number is a mobile number that was previously assigned to one subscriber and is later allocated to another person.
Mobile operators have a limited supply of telephone numbers. When subscribers permanently stop using their lines, operators may eventually return those numbers to circulation under the applicable rules.
For example, imagine a Nairobi resident who stops using a Safaricom line after purchasing a new Airtel number. The person updates their friends but forgets to change the old number registered with an online shopping account and an email recovery service.
Months later, the old number is assigned to another subscriber.
The new owner does not automatically inherit the former subscriber’s bank balance, M-PESA funds or ownership of their online accounts. However, services that still associate the number with the previous owner may create problems if their records have not been updated.
A verification message intended for the previous subscriber could reach the new owner. An old contact record might send private information to the wrong person. An account-recovery process that relies too heavily on SMS could also create an opportunity for unauthorised access.
The exact risk depends on the service’s security controls and whether the former subscriber has properly disconnected the number from their accounts.
Why Kenya wants a central database for recycled numbers
On 9 October 2026, Business Daily reported that the Communications Authority planned to establish a central database of recycled phone numbers.
Under the proposed framework, telecommunications providers would submit lists of deactivated and recycled numbers to the central system. Third parties, including banks, fintech companies and bulk-SMS providers, could use the information to check whether a number has changed ownership before sending messages connected to the previous subscriber.
The proposal is intended to address a gap between mobile operators and other organisations that store customer telephone numbers.
A telecom operator may know that a number has been deactivated and reassigned. A bank, online business or messaging service may still have the number recorded as belonging to its former customer.
The proposed database would help those organisations identify numbers that require updated records.
The CA’s procedures also address subscriber notification and the separation of personal information from numbers before they are reassigned.
An important distinction: The central database is a proposed safeguard, not a service consumers should assume is already operational. Its implementation and the final requirements will depend on the applicable regulatory process.
How recycled numbers could affect M-PESA and banking
Mobile numbers play an important role in Kenya’s digital financial system.
Customers use them for mobile money, transaction notifications, account verification and communication with financial institutions. That convenience becomes a potential weakness when an old number remains attached to an account after its owner stops using it.
Consider three examples.
1. M-PESA and mobile-money accounts
A customer changes phone numbers but fails to follow the provider’s procedures for updating their account details.
If the old number is eventually reassigned, the new subscriber might receive messages intended for the previous owner.
That does not mean the new subscriber automatically gains access to the former owner’s M-PESA account or balance. Access to financial accounts depends on additional authentication and the provider’s security controls.
The risk is that outdated contact information can expose transaction-related information, create confusion or complicate account recovery.
If you are changing your number, contact the relevant provider and follow its official process for updating your account details.
For more practical advice, read TechDrivers’ guide on how to protect your M-PESA account from fraud in Kenya.
2. Email and social-media accounts
Many online services use a phone number to send verification codes or help customers recover access to their accounts.
If an old number remains registered, the new subscriber could receive messages intended for the former owner.
Whether this creates an account-takeover risk depends on the service. A secure platform may require a password, an authenticator or another verification step before allowing access.
Nevertheless, leaving an old number attached to important accounts creates an avoidable security and privacy problem.
Prioritise your primary email account because it may be used to reset passwords for other services.
3. Banks, businesses and customer databases
A business may continue sending payment reminders, one-time passwords or account notifications to a telephone number long after its original owner has stopped using it.
This can expose personal information to an unintended recipient and create confusion for both the business and the new subscriber.
The proposed central database is intended to help service providers identify reassigned numbers and update their records before communicating with them.
Its effectiveness will depend on implementation, accurate records and the extent to which relevant organisations use the system.
Recycled numbers versus SIM-swap fraud: What is the difference?
These two issues are related to mobile-number security, but they are not the same.
| Issue | Recycled phone number | SIM-swap fraud |
|---|---|---|
| What happens? | An old number is reassigned to a new subscriber. | A criminal fraudulently obtains control of a victim’s number or SIM service. |
| Is criminal activity always involved? | No. Number recycling can be a normal telecom process. | Yes. Fraud involves unauthorised or deceptive action. |
| Main concern | Old accounts and databases may still associate the number with the former owner. | The criminal may receive calls or SMS messages intended for the victim. |
| Key protection | Update accounts before abandoning a number. | Protect SIM registration, account credentials and carrier access; report suspicious loss of service immediately. |
A recycled number does not automatically give its new owner access to the previous owner’s accounts. Similarly, a SIM swap does not mean a number has been permanently reassigned.
Both situations show why a phone number should not be treated as sufficient proof of identity on its own.
For a deeper explanation, read TechDrivers’ article on how SIM-swap fraud works in Kenya and how to protect yourself.
Seven steps to protect your accounts before changing your number
You do not have to wait for Kenya’s proposed database to be implemented before protecting your digital accounts.
1. Update your primary email account first
Your email account may be the gateway to many other services.
Open your email security settings and check the recovery phone number, recovery email and other verification methods. Replace the old number with your current one and confirm that the change has been saved.
Do not remove your only recovery method until you have successfully configured an alternative.
2. Follow the official M-PESA and bank account-update process
If you are changing your registered mobile number, contact your mobile-money provider and bank through their official channels.
Ask what is required to update your registered contact details and whether any additional identity verification is necessary.
Do not assume that changing the SIM card in your phone automatically updates every financial account linked to the old number.
3. Secure your WhatsApp account
If you intend to keep using WhatsApp with a new number, use the app’s official Change Number feature before abandoning the old line, where possible.
This allows you to migrate your account to the new number instead of leaving it associated with a number you no longer control.
Enable two-step verification and add a recovery email address if the feature is available to you. Never share your WhatsApp registration code with another person.
4. Review your banking and payment applications
Check your banking apps, digital lenders, online payment services, investment accounts and shopping accounts.
Update your telephone number through each provider’s approved process. Review recovery settings and remove the old number when it is no longer required.
If an account does not allow you to change your number online, contact the provider before giving up the old SIM.
5. Enable stronger authentication where available
Use an authenticator app, passkey or another supported authentication method for important accounts where possible.
These methods can reduce dependence on SMS verification, although the strongest available option depends on the service and your circumstances.
Use unique passwords for important accounts and enable additional security protections where supported.
6. Protect your SIM and personal information
Never disclose your M-PESA PIN, banking password or one-time verification code to someone claiming to be a customer-care representative.
Be cautious about unexpected requests to approve a SIM replacement or confirm account details.
If your phone suddenly loses mobile service without an obvious explanation, contact your operator through an official channel to establish whether the SIM or line has been affected.
For more guidance, see TechDrivers’ article on blocking a stolen phone in Kenya and protecting your SIM, M-PESA and accounts.
7. Keep your current number active until the transition is complete
Before abandoning an old number, make a checklist of the services connected to it.
Update those accounts, verify that you can sign in using your new details, and confirm that your important recovery methods work.
If you need to preserve a number, ask your operator about the available options and applicable terms.
Do not rely on receiving an SMS at an old number after it has been deactivated or reassigned.
What the proposed CA database could change
The proposed database could help close an information gap between telecommunications companies and organisations that send messages to mobile numbers.
Its potential benefits include:
- Fewer misdirected messages: Businesses could identify numbers that have changed ownership before sending communications linked to a former customer.
- Better customer-record management: Banks and fintech companies could identify outdated telephone numbers and update their records.
- Improved privacy safeguards: The system could reduce the risk of personal information being sent to unintended recipients.
- Clearer responsibilities: The proposed framework places greater emphasis on notification, record-keeping and protecting information associated with numbers before reassignment.
However, a database cannot solve every account-security problem.
It would not automatically update every customer record, guarantee that all businesses check the system or remove an old number from every online account. It also would not eliminate phishing, stolen credentials or SIM-swap fraud.
The effectiveness of the proposal will depend on how it is implemented, which organisations use it and how accurately the records are maintained.
What should you do if you receive messages intended for someone else?
If you receive bank notifications, payment reminders or verification messages intended for a person you do not know, do not attempt to access the person’s account.
Take these precautions:
- Do not share verification codes or private messages with strangers.
- Do not use a password-reset link intended for someone else.
- Contact the relevant organisation through its official website or customer-care channel to report the incorrect contact details.
- Avoid publishing screenshots containing account numbers, names, transaction references or other private information.
- If you believe your own account is at risk, contact the service provider directly and review your security settings.
Receiving an unexpected message does not necessarily mean your phone has been hacked. It may simply indicate that a business has outdated contact information.
The appropriate response is to report the problem without attempting to access another person’s information.
Frequently asked questions
Can someone access my M-PESA account if they get my old phone number?
Not automatically. Receiving a recycled number does not transfer ownership of the previous subscriber’s M-PESA account or balance. However, outdated contact information may create privacy and account-recovery risks. Contact Safaricom through official channels when changing your registered number.
How long before a Kenyan phone number is recycled?
The timing depends on the applicable rules and the operator’s procedures. The CA’s proposed framework describes three months without revenue-generating activity followed by a further three-month notification period. Do not treat this proposed timeline as a guarantee that every number will remain available for six months.
Is Kenya’s central database for recycled phone numbers already operational?
The CA’s central database was reported as a planned safeguard in October 2026. Readers should check official Communications Authority announcements for confirmation of implementation and the final rules.
How can I protect my WhatsApp account when changing numbers?
Use WhatsApp’s official Change Number feature where possible, update your account to the new number, enable two-step verification and secure your recovery email. Never share your registration code.
What should I do if my SIM card suddenly stops working?
Contact your mobile operator through an official channel immediately. Establish whether the problem is a network outage, a SIM issue or an unauthorised replacement. If you suspect fraud, contact your bank or mobile-money provider as appropriate and secure your affected accounts.
Is number recycling the same as SIM-swap fraud?
No. Number recycling is the reassignment of a previously used number to a new subscriber. SIM-swap fraud involves unauthorised or deceptive actions to take control of a victim’s mobile service. Both can create security risks, but the causes and protections differ.
Can I keep my phone number permanently?
That depends on your operator’s services, the applicable regulations and the arrangements available to you. Contact your provider about preserving an inactive number or maintaining the line before allowing it to be deactivated.
Conclusion: Your phone number is part of your digital identity
Kenya’s proposed central database for recycled phone numbers highlights a growing challenge in digital security: a telephone number can remain connected to a person’s financial and online identity long after they stop using it.
For consumers, the most effective immediate protection is to update account details before abandoning a number, secure email and financial accounts, and avoid relying exclusively on SMS for authentication where stronger options are available.
For banks, fintech companies and other service providers, the challenge is to ensure that customer records reflect changes in number ownership and that private information is not sent to unintended recipients.
The proposed CA safeguards could help address part of this problem, but their impact will depend on implementation and cooperation across the digital ecosystem.
The lesson for every Kenyan mobile-phone user is simple: when you change your number, update your digital identity too.
TechDrivers will continue covering the cybersecurity, telecommunications and digital-finance developments affecting Kenyan consumers and businesses.
