Instagram lets users sign up with their phone number (verified by a pin sent via text), a username and password. Should you forget your password, you can request a link sent via text to your phone, to reset your password.
It hit me today that phone numbers can be reassigned to new people if they are no longer being used - so consider the following:
I make an instagram account with my phone number. I then get a new number, and don't bother updating/removing the details. Someone who got reassigned my old number then requests a password change, and voila - they have access to my instagram account?
Seems like lyft has actually experienced something like this: https://arstechnica.com/security/2016/02/when-phone-verification-and-recycled-numbers-collide-lyft-leaks-user-data/
So what can be done by companies using phone numbers for verification to avoid this (in my opinion) security issue?