SMS based authentication, handling recycled phone numbers?

Question

If a site requires you to authenticate with only a phone number and a one time login code, what safeguards can be put in place such that when I change my phone number and the phone company recycles it, that the person who has my old phone number doesn't accidentally or maliciously gain access to my account on that site?

To clarify, the login screen for this site says "enter your phone number", when you do it sends you a text message with a code, the screen then says "enter the security code". Upon doing so correctly, you are now considered authenticated.

I am not sure of a way to prevent a recycled phone number from gaining unwanted access to an account.

This is assuming that the person who actually owns the account has left it without de-activating it or changing their phone number. This is also assuming the daily traffic for the site is in the tens of thousands range.

Answer 1

SMS authentication works well as part of a 2-factor authentication scheme, on it's own? Not so much.

If the phone number and the value of the code sent in the SMS are the only things required to login then this is vulnerable not just to recycled numbers but anyone who knows the number and can read SMS's sent to it.

Since you were specifically asking about recycled numbers then really the only ways to defend against this threat model are either for user to ensure that they deactivate the link between the account and the phonenumber of for the operator of the site to use a service which provides phone number deactivation information such as PhoneID:

https://www.telesign.com/products/phone-id/

This uses data from telco providers to indicate when a number has been dactivated or changed hands etc.

Answer 2

There's no safe guards against the scenario you describe. Just not possible unless you purposefully change all of the attached information when you go to change numbers, which is doable only on certain systems since you might need both numbers to accomplish changing the 2FA if it's mandatory. Other systems let you turn off 2FA, you can then turn it off and change your number and turn it back on with the new number.

I would recommend using a VOIP provider to give you a phone number (Google Voice is free) and using that number as your 2FA phone number. Then you should have it forward everything to your current physical cell number. When you get a new number just change where it forwards to if this is a serious concern. However, I should point out that SMS is NOT a secure channel for 2-Factor Authentication for various reasons, especially using a VOIP provider since that's just another location for SMS data to be accessible from, and should not be used where possible.