Old Phone Number Recycled? Protect Your Accounts

You let an old prepaid line lapse, or you changed telco and never moved your accounts across. Now a login screen sends its code to a number you no longer have, or a stranger tells you they keep getting your OTPs. In Bahasa Malaysia people search it as "nombor lama dikitar semula"; in Chinese as "旧号码被回收".

The short answer: the number is gone, but most accounts are not. Replace the old number everywhere you are still logged in, move two-step verification to an authenticator app, and use email or backup codes for the accounts you are locked out of.

This guide explains how recycling works in Malaysia, the order to fix things in, how to handle WhatsApp, and what to do if you are the person receiving someone else's codes.

Last checked: 29 September 2026.

#What Happens When Your Old Number Is Recycled?

A recycled number is one your telco has cancelled and later issued to a new customer. From that moment, every text message sent to it, including login codes and password reset links, goes to the new holder. Any account that still lists your old number for sign-in or two-step verification can be reset by whoever has the SIM, often without meaning to. So the fix is not getting the number back. It is taking the number off your accounts before the new holder, or someone who tricks them, uses it.

#Can the Telco Give Me My Old Number Back?

Usually you should not count on it. MCMC's prepaid registration guidelines (MCMC/G/01/17) say a service provider is entitled to recycle the number of a terminated prepaid service and is under no obligation to re-issue the same number to you in a future registration.

There is a delay first. MCMC's Numbering and Electronic Addressing Plan says a cancelled number that has been in use cannot be re-issued for at least six months from the date of cancellation. MCMC calls this the cooling-off period, during which the number sits in quarantine.

If your line lapsed recently, you can ask your telco whether the number is still in quarantine and whether it can be restored, but the rules do not require it to agree. Each telco also sets its own prepaid validity and grace period, so check its terms for how long a line survives without a top-up. Either way, start moving your accounts today rather than waiting for an answer.

#Which Situation Are You In?

What you can do depends on two things: whether you are still logged in, and whether the account has a second way to reach you. Work through this in order.

1. Still logged in on at least one device? Yes: replace the number in that app's settings now, before you log out anywhere. No: go to step 2.
2. Does the account have a working email, backup codes, an authenticator app, a passkey or a trusted device? Yes: use that route to sign in, then replace the number. No: go to step 3.
3. Is the account worth the effort of an identity check? Yes: use the platform's own "can't access" or account recovery flow and expect questions about your devices and history. No: consider closing it or letting it go, and make sure it does not hold payment details.
4. Did money move, or did you share a code with anyone while this was happening? Yes: go straight to the section on scams and reporting below.

If a platform only knows your old number and you are fully logged out, our guide to getting back in without your old email, phone or 2FA covers what platforms usually ask for and how to prepare.

#Make a List of Every Account on the Old Number

Before you change anything, write the list. People usually remember Google and WhatsApp and forget the shopping app that texts a login code. Check each of these:

• Email accounts: Google, Outlook, Yahoo. Email comes first because it resets everything else.
• Messaging apps: WhatsApp, Telegram, Signal, WeChat.
• Social media: Facebook, Instagram, Threads, TikTok, X, LinkedIn.
• Money: online banking, e-wallets, card apps and anything that sends a TAC or OTP by SMS.
• Shopping and delivery apps that log you in with a phone number.
• Apple or Google device accounts, and password managers.
• Government and work portals that send codes by SMS.

For banks and e-wallets, update the number through the bank's own app, branch or official hotline printed on your card. Do not act on an SMS or call that says your number needs updating; that is a common scam opening.

#Where the Number Lives and What to Change

#Google: Change the Number and Expect a Waiting Period

Google's page on changing the phone number on your account says to open your Google Account, go to "Personal info", then "Phone", where you can update or remove a number. It also warns that changing the number there only affects some Google services, and lists 2-Step Verification as a separate place to change it.

Plan for a delay. Google says it may take a week before you can use a new number to verify it is you for sensitive actions like changing your password. Its 2-Step Verification page says a newly added 2SV phone number may take up to 7 days to be trusted. Do not remove your other sign-in methods during that window.

Google also says text and call codes can be vulnerable to phone number-based hacks, and that Google prompts help protect against SIM swap. Add prompts, Google Authenticator or a passkey, and print a set of backup codes. If you have already lost the second step, our guide to recovering Google 2-Step Verification after losing your phone goes through the options.

#Facebook and Instagram: Update Accounts Center

Meta's help page on adding or removing a mobile number puts the setting in Accounts Center, under "Personal details" and then "Contact info". Add the new number and enter the confirmation code first, then select the old number and choose "Delete number". Meta recommends always adding an email so you can get back in if you lose your phone.

Instagram's two-factor number is stored separately. Meta's page on changing the phone number for two-factor authentication says to go to Accounts Center, "Password and security", "Two-factor authentication", pick the account, choose "SMS or WhatsApp" and then "Use different phone number". Instagram then shows a list of backup codes. Save them before you tap "Done".

#WhatsApp: The Number Is the Account

WhatsApp is different because the phone number is your identity. Its page on registration and two-step verification says a registration code sent by SMS or call is the only way to activate an account, and that after a number is registered, anyone else using that account is automatically logged out. So if the new holder installs WhatsApp on your old number, your session on that number ends.

If you still have the old number registered and a new SIM in hand, move now. WhatsApp's change number guide says your old number must still be registered on WhatsApp and your new number must be able to receive SMS or calls. On Android the path is Settings > Account > "Change number". WhatsApp adds that cloud backups are tied to the number used to create them, so make a fresh backup after the change.

If the number has already gone, your chats on that account may not come back. WhatsApp says on its page about inactive account deletion that accounts are generally deleted after 120 days without connecting. Register WhatsApp on your new number, and tell contacts yourself, through another channel, that your old number is no longer you.

#Got a Recycled Number and Receiving Someone Else's Codes?

This part is for the new holder. If your new SIM gets login codes, bank TACs or WhatsApp notices you did not request, they belong to the previous owner. WhatsApp's page on codes you did not request says this often happens when someone mistypes their number, and can also happen when someone tries to take over an account.

• Ignore the codes. Never forward them, not even to someone who says they are the old owner.
• Do not use a code to open anyone else's account, even out of curiosity. It is not yours to enter.
• Block persistent callers and senders with your phone's own block feature.
• If a caller pressures you for a code, hang up. Scammers use the same script.
• If you want WhatsApp on the number and the previous owner had two-step verification on, WhatsApp says you will need to wait a few days before you can reset access.

On that last point, WhatsApp's forgotten password page says the option to reset an account becomes available after a few days when two-step verification cannot be completed, and that a reset cannot be undone. That reset is for registering the number you now legitimately hold. It does not give anyone the previous owner's messages.

#Mistakes That Leave Accounts Exposed

• Logging out of every device before replacing the number, which removes your easiest way back in.
• Changing the number on Google's "Personal info" page and forgetting 2-Step Verification, which is stored separately.
• Deleting the old number before the new one is confirmed.
• Keeping SMS as the only second step when an authenticator app or passkey is on offer.
• Skipping the backup codes screen because you are in a hurry.
• Asking the new holder to forward a code. It puts both of you at risk and teaches them to hand codes to strangers.

If your number stopped working suddenly while you were still paying for it, that is a different problem. A line that shows "No service" out of nowhere can mean someone moved your number to their SIM. Our guide to SIM swap attacks in Malaysia covers what to ask your telco.

#If You Lost Money or Shared a Code in Malaysia

Deal with the money first. The NSRC's FAQ on the NFCC website says to contact your bank's hotline or the NSRC on 997 immediately after spotting an unauthorised transaction, then make a police report at the nearest police station as soon as possible. Keep the messages, numbers and transaction details, because the NSRC lists them as the information you will need.

A phishing link or a suspected account takeover can also be reported to CyberSecurity Malaysia's Cyber999 incident response centre, by online form, email, phone or its mobile app.

#When a Case Review Makes Sense

Most people can fix a recycled number alone with the list and settings above, and only each platform can decide whether to let you back into an account that is locked. Some accounts whose only recovery route was the old number do not come back. A second opinion helps when a business account, a creator profile or several linked accounts all hung off one lapsed number, or when a lockout and a possible takeover are tangled together. SocialSafe by AwareXone, our recovery service, looks at the case before anything is agreed and tells you plainly whether an official route is still open. You can read how our account security service works, and our Trust Center explains why we will never ask for your password or a single code.

#Frequently Asked Questions