by Serguey Shinder
In June 2025 a man rang our customer service line to ask us, politely, to stop sending him login codes. He had not asked for any. He had never bought anything from us. He had simply had his mobile number for eight months, and several times a week it received a six digit code with our name on it.
The account belonged to a plumber who had last ordered from us in 2022. When he signed up, we had sent a code to his mobile, he had typed it back, and from that moment our system marked the number as verified. Since then he had changed networks and let the old number go, and the network had done what networks do with unused numbers, which is give them to somebody else. Somebody, probably a bot trying addresses from an old breach, had been requesting password resets on his account, and every reset code went to a stranger.
The stranger was honest. The design was not safe. Anyone who held that number could have reset the password, seen six years of delivery addresses, and ordered on the plumber's trade credit for delivery wherever they liked.
What I had wrong was the word verified. We treated it as a fact about the number. It was only ever a fact about one afternoon in 2019, when the person who typed in the code was the person who owned the phone. A mobile number is rented, not owned, and in most countries a number left unused goes back into the pool within months. Our records had no way to notice. The longer a customer had been away, the more confident we were about how to reach them, which is exactly backwards.
When we counted, a little over four thousand active accounts had a mobile verified more than three years earlier and no login in the past eighteen months. We could not know how many of those numbers now belonged to someone else, and that was the point.
So verification now has an age. A number confirmed more than a year ago is reconfirmed at the customer's next login, which costs them one code and a tap. An account that has not been used for a year cannot be recovered by text message alone. The reset also needs the email address on file, and for trade accounts with credit terms a call back to the number on the original credit application. The reset text itself no longer names the business or the account, so a stranger who receives one learns nothing from it.
The plumber came back to us that autumn, as it happens, and reconfirmed a new number without noticing anything had changed. The man who rang has not heard from us since.
– Serguey Asael Shinder
Leave a Reply