1

Does anyone have any examples of flows for dealing with recycled phone numbers? For example - User A registers with app using a phone number. - User A stops using this phone number some time later but still has an account. - User B (many months or years) later, obtains a new cell phone with this same number. They go to register an account with the phone number only to find out this was used previously on the site.

How does user B claim this number? If there was no email ever received during time of registration, there is no way to notify User A that someone has claimed their number.

Is this an edge case? Has anyone run into this issue? How did you handle it?

1

With contact details like phone numbers a emails it's good practice to periodically request a user to verify that their contact details are up to date.

For primary account identifiers, mostly user names, but can be phone numbers can periodically be reclaimed by the system. When the application "notices" that an account hasn't been accessed in a years time. It notifies the user that their account is eligible for deletion unless they log in and verify their existence. A second notification with a 24 hour notice can be sent as a precaution. If no one claims the account – delete it.

Although most of the times we don't do a "hard delete" of an account. We mostly only mark it as inactive. Depending on the type of data stored in the account we will only "hard delete" sensitive data and keep things such as contact details.

In your scenario

If the application calls the number (shared by both parties) to get confirmation of identity. Simply question whoever answers the phone to recite other data points that were stored in each user account, eg. Please recall your address. If the person at the end of the line recites User A's address, User A is also User B. Otherwise it is a new user B with a recycled number. If there are no other identifiable data points stored for User A. User B may claim the number and User A's account is simply closed.

1

Simples, as the annoying puppets say on TV.

SMS the number with a verification code and a message to ignore if the number belongs to someone else and they didn't request registration.

If they type the code into the website, they have possession of a phone with that number and you can reassign it to that user.

SMS Phone Exists

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.