Security risks of recycled SIM numbers in Bangladesh
Last updated 2026-07-07 By Adnan Siddiqui
When a mobile number is recycled and reissued to a new customer, the previous owner’s digital life does not always move with them. Banking OTPs, social logins, and two-factor codes can still arrive on that line. This guide explains what can go wrong, who is most at risk, and the practical steps to take before and after you start using a recycled Grameenphone or other operator number.
Why recycled numbers are a security problem
A recycled number is one that belonged to someone else before the operator permanently deactivated it and later assigned it to a new SIM. The new owner gets a fresh connection, but many online services still treat the number as the old user’s identity. Password resets, one-time passwords (OTPs), and “verify by SMS” flows send codes to whoever currently holds the SIM — not necessarily the person who registered the account years ago.
OTP hijacking — the most common risk
One-time passwords are the backbone of account security in Bangladesh. When you request a login or password reset, the service texts a short code to your registered number. If that number was recycled:
- The new SIM owner may receive OTPs meant for the previous user.
- An attacker who knows (or guesses) that a number was recycled can try “forgot password” on popular services and intercept the code.
- Some apps send silent verification SMS without clearly naming the service, making it easy to miss that someone else’s account is involved.
Mobile banking: bKash, Nagad, and bank SMS
Mobile financial services in Bangladesh are tightly linked to SIM numbers. bKash, Nagad, Rocket, and bank apps often use SMS OTP for login, PIN reset, and transaction confirmation. If the previous owner did not unlink their wallet or bank profile before the number was recycled, the new holder could theoretically receive sensitive codes. In practice, MFS providers add extra checks (NID, fingerprint at agent points), but SMS-based steps remain a weak point. Never use OTP codes that arrive for services you did not initiate — and if you start receiving banking SMS for another person’s name, treat the SIM as compromised for financial use until you have cleared it with the provider.
Social media and messaging account takeover
Facebook, WhatsApp, Instagram, and Telegram commonly use phone-number verification. A recycled number may still be registered on an old account. The new SIM owner might:
- Receive “Your WhatsApp account is being registered on a new device” warnings that are not theirs.
- Get Facebook or Instagram password-reset codes for a stranger’s profile.
- Accidentally complete a verification flow and link the number to their own new account, locking out the previous owner — or the reverse, where the old account remains tied to the number.
Who should worry most
Risk is highest if you bought a SIM specifically because the number looked “easy” or VIP (repeated digits, memorable patterns). Those numbers recycle more often because they were held by many short-term users. Anyone buying from a street reseller without checking the number’s history should also verify whether it appears on public recycled lists before trusting it for banking or primary social accounts.
Before you activate: a quick safety check
Run through this list on day one, before you link the SIM to anything important:
- Search the number on this site (or Grameenphone’s official recycled list) to see if it was permanently deactivated.
- Insert the SIM and wait 24 hours — note any SMS arriving for names or services you do not recognise.
- Do not immediately register bKash/Nagad or primary email recovery on the line until SMS traffic looks clean.
- If you bought the SIM to reclaim your own old number, contact the operator (GP: dial 121) rather than relying on third-party sellers.
If you receive someone else’s OTPs
Do not enter codes into any app or website. Do not reply. Document the sender and message text, then:
- Contact the operator’s customer care and report that the number appears to carry over previous-owner traffic.
- For banking or MFS SMS, call the provider’s helpline and explain you have a newly issued SIM receiving another customer’s alerts.
- Consider requesting a different number from the operator if the issue persists — recycled does not mean you must keep a problematic line.
Protecting yourself long term
Use app-based two-factor authentication (Google Authenticator, Authy) instead of SMS where possible. Use a separate email for financial accounts. When you eventually change numbers, unlink old SIMs from every service before the line goes inactive — that reduces harm for the next person and for you if you ever get a recycled number yourself.