Can a carrier lookup tell me if a phone number has been recycled?

No. A carrier lookup returns carrier, country, number type and active status for a number as it stands today. It cannot tell you the number has been reassigned to a different person. Telebase does not offer a reassignment check. Detecting reassignment against a reference date requires an operator-verified number recycling service, which is a separate product specified under the CAMARA and GSMA Open Gateway initiative.

How can I use carrier and active status to detect a possibly recycled number?

Store carrier, number type and active status with a timestamp when you first capture the number, then re-check before you rely on it, for example before sending a one-time password to a dormant account. A change in carrier, a change in line type, or active becoming false means the number may no longer reach the same person, and should trigger re-verification rather than an automatic decline. A customer porting to a new network produces the same carrier change, so this signal has a high false positive rate if used to block.

Why are recycled phone numbers a security risk?

Disconnected numbers are returned to the operator's pool and reissued after an ageing period, which the US Federal Communications Commission sets at a minimum of 45 days. The number keeps working as an identifier at every service the previous holder did not update, so password resets and one-time passwords can reach the new holder. A Princeton study of number recycling sampled 259 available numbers and found 171 still tied to accounts at popular websites.

Signal limits

Recycled phone numbers: what a carrier lookup can and cannot tell you

A carrier lookup cannot tell you that a phone number has been reassigned to a different person. Telebase does not answer that question and neither does any lookup that returns carrier, country, number type and active status. What those fields give you is a store-and-recheck pattern: record them when you first see a number, compare them later, and treat a change as a reason to re-verify rather than as proof of anything. This page explains the pattern and the four ways it misleads you.

How number reassignment actually works

When a subscriber stops paying, the operator eventually disconnects the line and returns the number to its pool. After an ageing period the number is issued to somebody new. In the United States the Federal Communications Commission sets a minimum of 45 days between permanent disconnection and reassignment. Other markets set their own periods and some are shorter.

The security problem is that the number keeps working as an identifier at every service the previous holder never updated. Researchers at Princeton, in their study of number recycling at mobile carriers, sampled 259 numbers available to new subscribers and found 171 of them still tied to accounts at popular websites. A one-time password sent to a number the account holder no longer controls is delivered to whoever holds it now.

What each field can and cannot prove

active tells you the line is reachable on the network right now. It does not tell you who is holding it. A reassigned number is fully active for its new owner.
carrier tells you which network serves the number today. A change since you last looked is consistent with reassignment, and equally consistent with the same person switching provider and keeping their number.
numberType tells you the class of line. A number that was mobile and is now nonFixedVoip is a meaningful change. It is still not an identity check.
country rarely changes and is mostly useful for catching data-entry and migration errors in old records.

None of these is a reassignment oracle, and any vendor implying otherwise from the same four fields is overselling. What they do support is comparison over time, which is a different and more modest thing.

The store-and-recheck pattern

1. Record the baseline

At onboarding, store carrier, number type, active status and the date you captured them alongside the number itself. This costs one lookup and is the step most teams skip, which is why the pattern is unavailable to them later.

2. Re-check before you rely on the number

Not on a fixed schedule for every record, which is wasteful, but at the moments the number carries weight: before an SMS one-time password on a dormant account, at a KYC refresh, before a high-value action, or when re-engaging an account that has been quiet for a long period.

3. Compare, and route rather than block

Carrier changed, or active flipped to false, or the line type changed class. Any of those means the assumption behind your stored number may no longer hold. The right response is a re-verification step, not a decline. Blocking on this signal alone will hit a large number of customers who simply switched network.

4. Write the new values back

Otherwise the next comparison runs against a stale baseline and the whole pattern degrades quietly, which is the failure mode nobody notices for a year.

Four ways this misleads you

Porting looks like reassignment. A customer moving from one network to another keeps the number and changes the carrier value. This is the single largest source of false positives, and it is why the output is a re-verification trigger rather than a risk score on its own. Our note on mobile number portability covers the mechanics.
Inactive is not always permanent. A line can read inactive for reasons that resolve, including unpaid bills that get settled and roaming states. Inactive means do not rely on this number today, not this number is gone.
A weaker active check reads the same as a strong one. The response carries the source of the active status. Where it is a format-level check rather than a line-status check, the value deserves less weight. Treat the two differently or you will build confidence you have not earned. The active status page covers this distinction.
Nothing here identifies a person. These are network facts about a line. They narrow the question of whether the number still reaches the customer you think it reaches. They never answer it outright.

When you need a different tool

If your control requires a definitive answer to "has this number been reassigned since a given date", that is a distinct product built on operator-verified data, and the industry has standardised an interface for it. A Number Recycling API is one of the specifications published under the CAMARA and GSMA Open Gateway initiative, and several providers offer implementations of it. Telebase does not offer that call today. Our comparison of CAMARA and direct carrier APIs sets out the trade-offs between the two models.

Being clear about the boundary is the point. Buying a carrier lookup and treating it as a reassignment feed produces a control that looks fine in a policy document and does not work.

Example call

Request

GET https://api.telebase.io/lookup?phone=%2B447700900000
Authorization: Bearer tb_live_xxxxxxxxxxxxxxxxxxxxxxxx

Response, 200 OK

{
  "phoneNumber": "+447700900000",
  "active": true,
  "carrier": "EE",
  "country": "GB",
  "numberType": "mobile",
  "simSwap": "UNKNOWN",  // launching
  "simSwapAt": null,
  "_meta": { "activeSource": "LINE_STATUS" }
}

Store the carrier, numberType, active and _meta.activeSource values against the account, with a timestamp. The comparison is what makes the second lookup worth running.

What re-checking costs

At $0.05 a lookup, re-checking is cheap enough that the design question is when to do it rather than whether you can afford it. Re-checking an entire back book on a fixed cycle is usually the wrong shape, because most of those numbers are not about to be relied on for anything. Our page on caching and cost control for per-query APIs covers how to keep the volume sensible.

Request early access