Quick answer. In India, any mobile number that stays unused or unpaid for roughly 90 days can be deactivated by your telecom operator and, after a short quarantine, reassigned to a new subscriber under TRAI norms. If your old number is still linked to your bank, Aadhaar, UPI, email, DigiLocker, EPFO, income-tax, insurance or demat account, whoever gets it next can receive your OTPs and reset your logins. Open Sanchar Saathi TAFCOP today, list every number registered in your name, then walk through each authority and update the mobile on record before you surrender or lose any SIM.
If you only have five minutes right now, jump straight to the 30-minute action plan and start there.
Mobile number recycling is the regulated process by which Indian telecom operators reclaim a number after prolonged inactivity or non-payment, hold it in quarantine, then reallot it to a new subscriber. The old subscriber loses the number permanently.
Three facts almost nobody connects until it is too late:
If you have ever surrendered a SIM, stopped paying a postpaid bill, lost a phone abroad, or let an old SIM die in a drawer, this article is for you.
TRAI and DoT have allowed operators to reclaim unused numbers since the early 2000s. The threshold most operators apply today is 90 days of continuous non-usage for prepaid (no outgoing calls, no SMS, no data, no recharge), after which the number is deactivated. A quarantine period follows (15 days to about 6 months) before the number returns to the active pool.
For postpaid, the trigger is non-payment plus disconnection notice. Recycling is the same.
Key point: once the quarantine ends, the new owner has every right to use the number, including for OTPs to banks, government portals and apps. The system is working as designed; the digital stack just did not get the memo.
If you do nothing, here is the chain a recycled number can unlock for a stranger, in roughly the order it tends to happen.
The mobile number is the master key to your Indian digital life. Recycling it without rotating the locks is the risk.
If you have a dormant number, or suspect a SIM in your name has lapsed, work through this in order. Most people finish in half an hour.
You may not finish in 30 minutes, but the triage closes the OTP gate on highest-risk accounts first.
Now slow down. Open a spreadsheet, list every account, current mobile on record, and date confirmed. Treat it like a yearly tax exercise.
If you are doing this because something has already gone wrong (you tried to log in and the OTP went somewhere else), or because you have inherited the SIM and accounts of a deceased family member, build an evidence folder before you touch anything else.
Put all of this in one folder named YYYY-MM-DD-recycled-number-evidence. You will refer to it many times over the next few weeks.
There is no single “I lost my number” desk. You will use three official channels in parallel.
If you have already lost money, also dial 1930 immediately. The full script is in the 1930 cyber fraud helpline guide.
Most readers are doing preventive cleanup with no money lost - police not required.
You must involve them in these situations:
For financial losses, dial 1930 in the golden hour and follow up at https://cybercrime.gov.in/. For non-financial offences, file an FIR at the local police station or online cyber cell. Cite the Bharatiya Nyaya Sanhita (BNS), 2023 (cheating, forgery, identity theft) and the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023 for procedure. IT Act §§66C (identity theft) and 66D (impersonation) continue to apply.
If your bank refuses to freeze, see the bank freeze process after cyber fraud page for the escalation ladder.
Below are nine sample bodies. Adapt the bracketed fields. Send by registered post or upload through the institution's grievance portal. Always include a self-attested ID proof and your evidence folder.
To, The Nodal Officer [Operator name, circle] Subject: Request for written confirmation of deactivation and recycling status of mobile number [XXXXXXXXXX] Sir / Madam, I, the undersigned, was the registered subscriber of mobile number [XXXXXXXXXX] from approximately [start date] to [end date]. The connection was a [prepaid / postpaid] service in my name, with PoI document [Aadhaar / passport / DL] number [XXXX masked XXXX]. I have reason to believe the number is no longer active in my name. Under the Telecom Consumers Protection Regulations and the operator's published terms, I request: 1. Written confirmation of the exact date on which my connection was deactivated. 2. Written confirmation of whether the number is still in quarantine or has been reassigned. 3. A copy of the closure log entry. This information is required to update my linked Aadhaar, bank and government records and to protect against impersonation. Please respond within 15 working days as per the Telecom Consumers Complaint Redressal Regulations. Yours faithfully, [Name] [Address] [Date] [Current contact number] [Email]
To, The Branch Manager [Bank name and branch] Subject: Request to update registered mobile number against account [last 4 digits] Sir / Madam, I hold savings / current account number ending [XXXX] in your branch. The mobile number currently registered against this account is [OLD number]. I no longer possess this SIM, it has been deactivated by my telecom operator and is no longer in my control. I request you to: 1. Update my registered mobile to [NEW number], enclosed PoI and PoA. 2. Disable any standing UPI mandates or net-banking sessions tied to the old number. 3. Re-issue net-banking credentials with the new mobile as the OTP destination. Enclosed: - Self-attested Aadhaar and PAN - Mobile-update form (Annexure as per bank format) - TAFCOP screenshot showing the old number is no longer in my name Yours faithfully, [Name] [CIF / customer ID] [Date]
This is initiated at an enrolment centre, not by post. Use the standard Aadhaar Update / Correction Form. Tick the mobile field. Carry your existing Aadhaar and the fee. For the procedural details and pitfalls, the dedicated UIDAI workflow on this wiki covers the steps.
To, The Grievance Officer NPCI Subject: Request to delink UPI ID [vpa@bank] from deactivated mobile [XXXXXXXXXX] Sir / Madam, I had registered the UPI ID [vpa@bank] using mobile number [XXXXXXXXXX]. This SIM has been deactivated by my telecom operator on or about [date]. I no longer have access to this number. I request NPCI to delink and deregister the UPI ID from this mobile number and remove any associated bank-account mapping, so that no further UPI registration can be initiated from a SIM that may be reissued. Enclosed: - Bank statement showing the linked account - TAFCOP printout - Self-attested Aadhaar and PAN Yours faithfully, [Name]
To, The Assessing Officer / Designated Authority Income-tax Department Subject: Request to update primary mobile and email on e-filing profile, PAN [XXXXX1234X] Sir / Madam, I am a registered e-filing user under PAN [XXXXX1234X]. The mobile number currently linked to my profile is [OLD number], which is no longer active. I have attempted to update through the portal, however the OTP cannot be received on the old SIM. Please facilitate updation of my primary mobile to [NEW number] and primary email to [new email] in the e-filing portal records. Enclosed: - Self-attested PAN and Aadhaar - TAFCOP printout - Latest filed ITR acknowledgement Yours faithfully, [Name] [PAN] [Date]
To, The Regional Provident Fund Commissioner [EPFO regional office] Subject: Request to update mobile number on UAN [XXXXXXXXXXXX] Sir / Madam, The mobile number registered against my UAN [XXXXXXXXXXXX] is [OLD number]. I no longer hold this SIM. Please update my mobile to [NEW number] in EPFO records so that I can complete KYC, raise advances, and view passbook updates. Enclosed: - Self-attested UAN card - PAN, Aadhaar - TAFCOP printout Yours faithfully, [Name]
To, The Policy Servicing Officer [Insurer name] Subject: Update of registered mobile and email across policy(ies) [policy number(s)] Sir / Madam, I hold the following policies issued by you. The registered mobile is [OLD], no longer active. - Policy 1: [number, type, sum assured] - Policy 2: [number, type, sum assured] Please update my registered mobile to [NEW] and registered email to [new email] across all policies in my name. Kindly issue a confirmation endorsement. Enclosed: - Self-attested PAN, Aadhaar - Policy schedule(s) Yours faithfully, [Name]
To, The Compliance Officer [Broker / DP name] Subject: Update of registered mobile on demat account [DP ID + Client ID] Sir / Madam, I hold demat account [DP ID-Client ID] with you. Registered mobile [OLD] is no longer in service. Please update to [NEW] and also reflect the change in CDSL / NSDL records and in the linked mutual fund folios serviced by [RTA]. Enclosed: - Mobile update form (as per broker format) - Self-attested PAN, Aadhaar - Latest holding statement Yours faithfully, [Name]
To, The DigiLocker Support Team National e-Governance Division Subject: Recovery of DigiLocker account [registered name / partial Aadhaar] Sir / Madam, I am a registered DigiLocker user. The mobile number on file [OLD] is no longer in my possession. I am unable to receive OTPs to log in or to change the number through the in-app flow. Please facilitate account recovery so that I can update the registered mobile to [NEW]. Enclosed: - Self-attested Aadhaar (masked) and PAN - Last known DigiLocker email - Any prior DigiLocker activity reference Yours faithfully, [Name]
R., Pune. Retired teacher, surrendered an old postpaid number in 2022. Kept paying LIC premium by auto-debit. Late 2025: tried to log in to LIC's portal for a tax certificate. OTP never arrived - mobile on record was different. Two policy-loan applications had been initiated against her policies in 18 months, both stopped at underwriting because the bank account did not match. Someone had used the recycled number to impersonate her. Took four months, two registered letters, a BNS cyber-cell complaint and an affidavit to lock the policies and update mobile everywhere. Cost: ~Rs 600 in postage plus one notarised affidavit.
The system silently kept R's old number on file for over three years across multiple authorities. None flagged it.
Many recycled-number disputes start here. A parent passes away, the SIM falls silent, three months later the operator recycles it. The parent's accounts in CAMS, banks, insurers remain active for years.
The right sequence:
Sleep better when no recycled number is connected to your parent's identity.
If a public authority (PSU bank, government insurance company, EPFO, income-tax) refuses to confirm in writing when the registered mobile was changed, or who accessed your account, you have a clean RTI path.
A short RTI under §6(1) of the RTI Act, 2005, to the PIO, asking for:
is enough to break most stonewalls. Cite §7(1) (30-day clock) and §19(1) (first appeal). New to RTI? See the citizen RTI playbook.
The widely applied threshold across Indian operators is 90 days of total non-usage for prepaid lines (no outgoing call, no SMS, no data, no recharge). After that the number is deactivated. A quarantine period follows, anywhere from a few weeks to a few months depending on the operator and the circle, before the number returns to the active pool. For postpaid lines, the trigger is non-payment and operator-initiated disconnection. The safer planning rule is: assume 90 days, no more.
Not on its own. But the old number combined with a leaked Aadhaar or PAN, both of which are widely available in data dumps, is often enough to satisfy the OTP step in onboarding flows. A bank's KYC requires more, including a video KYC or in-person verification. The danger is not bank account opening, the danger is that the OTP step on existing accounts (yours) can be passed.
It buys you another 90 days. It is a stop-gap, not a fix. Use the breathing room to update every account away from that number, then surrender the SIM cleanly through TAFCOP.
Three sweeps will catch most of them. First, search your email inbox for the last 5 years for the phrase “registered mobile” and for OTP-style SMS forwards. Second, log in to every banking and government app you use and read out the registered mobile from the profile page. Third, run a credit report from a CIBIL or Experian, the mobile and address on each tradeline are listed. Cross-reference and update.
WhatsApp is bound to the SIM. If the new SIM-holder installs WhatsApp on the recycled number, they will inherit it, unless you had enabled the two-step verification PIN. Always set that PIN. Always.
No. If your action is preventive and you find no unauthorised transactions, you do not need an FIR. Keep the TAFCOP printout and the response letters from each authority as your evidence pack. Open the FIR only if there is a confirmed loss, an impersonation attempt, or a refusal by an institution to honour your written request.
The telecom operator is a private body and not directly covered by the RTI Act. However, TRAI, DoT and Sanchar Saathi (under DoT) are covered. You can ask DoT under §6(1) for the policy governing recycling and quarantine periods, and for any complaint data on misuse of recycled numbers. You cannot ask for the new subscriber's identity, that is personal data of a third party and exempt under §8(1)(j).
No. Aadhaar is the master, but only services that re-fetch your Aadhaar profile (some KYC flows) will inherit the change. Most institutions store the mobile separately in their own database. Each one has to be updated by hand.
For most institutions, yes, with a signed authorisation letter, the account-holder's ID, and your ID. For Aadhaar, no, the account-holder must visit the enrolment centre in person, biometrics are required.
Then this stops being a cleanup project and becomes an incident. Dial 1930 for any money loss in the last 72 hours. File on https://cybercrime.gov.in/. Send the telecom operator and the affected institutions a written notice the same day. Lodge an FIR citing the relevant BNS sections on cheating, forgery and impersonation, and IT Act sections 66C and 66D. Freeze your demat, lock your CIBIL, disable UPI on every app.
A mobile number in India is a master key. Stop paying or using, and the key gets handed to the next person. The cleanest defence is the 30-minute action plan above, plus a yearly TAFCOP audit. Treat it like a tax-return habit.