Your Old Phone Number Is Still Logged Into Your Bank

You cancelled the old line. Somebody else has it now.

Here is how this usually goes. A business switches carriers. Or drops a line nobody uses anymore. Or a partner leaves and the old company cell gets shut off. Somebody calls the provider, cancels the number, and everybody moves on with their day.

About 45 days later, that number belongs to a stranger. And every account that still texts a security code to it is now texting that code to a person you have never met.

Nobody hacked you. The phone company did exactly what phone companies always do, which is put disconnected numbers back into the pool so the country does not run out of them. Tens of millions of numbers get recycled in the US every year. Yours was one of them, and the accounts you forgot to update never got the memo.

Researchers already ran this experiment

A team at Princeton did the obvious test. They pulled a sample of phone numbers that were available right now to new subscribers at two of the big carriers, then checked whether those numbers were still attached to a previous owner’s online accounts. Most of them were. Not a handful. Most.

The part that should bother you is how little effort it took. The new owner of the number did not need any hacking skill. They just needed to click forgot my password and wait for a text.

What actually breaks when the number goes away

• Bank and payroll logins that fall back to a text code when the app is not handy
• Email account recovery. This is the big one, because whoever controls your email controls the reset link for everything else
• Your merchant processor and accounting software. QuickBooks, Stripe, Square, all of them love SMS codes
• Your domain registrar, which is the account that quietly owns your website and your email routing
• Google Business Profile, which verifies you by phone and is the first thing a customer sees when they search your name
• Appointment and invoice reminders going out to your clients from a number a stranger now answers
• The number printed on your van, your business cards, your quotes, and every directory listing you ever filled out

The version of this that costs real money

Picture a two person shop in Boynton that moves off a cell line and onto a VoIP system. Good move, cheaper, better features. The old cell number gets cancelled the same week. Six weeks later a customer who has not called in a year dials the old number and gets a guy in another state who has no idea what they are talking about. That customer does not call back. They call the next result on Google.

Meanwhile the accounting login still lists the old number as the recovery method. So does the business bank account. All it takes is one bored person with a new phone number and a password reset page.

Do this before you cancel anything

1. Inventory first, cancel second. Search your inbox for phrases like verification code, we texted you, and your security code is. Every result is an account that has a phone number attached. Write them down. It is always more than you think.
2. Move your codes off SMS. An authenticator app on your phone (Microsoft Authenticator, Aegis, whatever your team will actually open) works when the number is gone, when you are on a plane, and when a scammer sweet talks a carrier rep into moving your line. Passkeys are better still where they are offered.
3. Fix the money accounts first. Bank, payroll, merchant processor, tax portal, domain registrar, email admin console. That order. Those six accounts are the ones somebody can actually monetize.
4. Port the number instead of cancelling it. This is the trick most people miss. You can port an old number to a cheap prepaid plan or a parking service for a few dollars a month and just sit on it. It never goes back into the pool, and you can forward it to your real line so old customers still land on you.
5. Overlap for 60 to 90 days. Keep both lines alive while you update listings. Yes it costs you two months of a phone bill. It costs less than the customer you lose.
6. Update everything public. Google Business Profile, website footer and contact page, invoice templates, email signature, Yelp, Facebook, your chamber listing, the magnet on the truck.
7. Kill old sessions. After you change the recovery number, sign out of all devices on your email and banking accounts so anything already logged in has to prove itself again.

If you already cancelled the line, here is your triage

Do not panic, but do not put this on next week’s list either.

• Start with email. Change the password, remove the dead number from recovery, add an authenticator app, then check the forwarding rules and filters for anything you did not create.
• Call your bank and your payroll provider directly using the number on your statement. Tell them the number on file is no longer yours and ask them to remove it as a verification method, not just update it.
• Check your domain registrar and your Microsooft 365 or Google Workspace admin account. Both of them can be used to take over your entire business identity.
• Look at your recent password reset emails. If you see resets you did not request, that is your answer about whether somebody is already poking at you.

The lesson underneath all of this

A phone number feels permanent. It is not. It is rented, and the lease ends the day you stop paying. Any security that depends on you holding a rented thing is weaker than it looks, which is why text message codes sit at the bottom of the list of good options. They beat nothing at all. They lose to an app, and they lose badly to a passkey.

Spend fifteen minutes this week on the inventory search. Just the inbox search for verification codes. You will find three or four accounts you completely forgot were tied to a number you are about to give up, and fixing them now costs you nothing but the fifteen minutes.

Not sure which of your accounts are exposed? That is the kind of thing we untangle for South Florida businesses every week, and the first conversation is free. Always happy to troubleshoot.