IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
New number, new phone, leaving
Maya gave up her old SIM last month. A stranger now has that number. Your app still sends her codes there. Your goal: keep her account safe when she changes number, changes phone or leaves.
- A phone number is a loan. After some months the phone company can give it to a stranger.
- Re-check a number now and then. One SMS alone should never reset an account.
- Moving an account to a new number needs a second proof. Tell the old number and the email.
- Maya must be able to see where she is signed in, and sign out everywhere.
- Deleting an account should be easy, with a short wait. Keep only what the law needs.
A phone number is not forever
Most apps trust a phone number. It gets Maya her OTPs and her password reset. But a number is a loan from the phone company. When Maya gives it up, the company can lend it to someone else after a wait (in India, at least 90 days). This is number recycling.
the letterbox of a rented flat. The old tenant leaves, but letters for them keep coming, and the new tenant can open them. If one is a bank letter with a reset link, the new tenant holds the key. The post office never tells the bank.
Maya feels none of this. The stranger taps "Forgot password", and the OTP lands on their phone. A thief can do this on purpose: see SIM swap.
What the company builds
- Store when you last checked the number. Check it again now and then. A number that fails stops being trusted.
- Never let one SMS reset an account. Ask for a second proof, such as an email link or a passkey. See recovery for customers.
When Maya changes her number
Changing a number moves the door, so it is a risky moment. A safe flow has four steps.
- Maya is signed in, and she proves it again with a step-up, such as her passkey.
- Send a code to the new number. It proves she holds it.
- Tell the old number and her email: "Your number was changed. Not you?"
- For accounts with money, add a short cooling-off period on big actions.
The old number may belong to a stranger, so keep the notice short, with no account details. The code to the new number proves only that someone holds that SIM, and a thief holds their own. That is why step 1 matters.
A new phone, and where she is signed in
With a new phone, Maya signs in again or uses a recovery route. Show a list of her devices: place and last use, with a "Sign out" button on each row and "Sign out everywhere" on top. The button must be easy to find and must work at once (see sessions and logout).
Leaving well
One day Maya wants to leave. Put "Delete my account" in settings, where she can find it. Hiding it is a dark pattern. Then build this.
- A step-up first, so a thief cannot delete her account.
- A short wait, such as 14 or 30 days, with an "undo" link. Then erase.
- Erase what you can. Keep only what a law requires, and tell Maya what and why.
See the right to be forgotten and the rules of the game, including India's DPDP Act.
Go deeper: Recycled numbers in India (as of October 2026)
In Rajeswari v. Union of India, the Supreme Court dismissed a petition on 30 October 2023. The petition asked the court to stop phone companies from reissuing numbers. TRAI told the court that a deactivated number is not given to a new subscriber for at least 90 days. It also said that numbering resources belong to the Department of Telecommunications. The court said the earlier subscriber should take care of their own privacy. For example, they can delete accounts tied to the old number. We found no newer notified rule. Check the DoT and TRAI websites before you plan around the 90 days.
Go deeper: Quiet accounts
Some customers just stop coming. A dormant account still holds a saved card, an old password and an old number. Nobody notices when an attacker signs in. Pick a quiet period that fits your risk. Warn Maya by email, then lock or close the account. She can return through normal recovery.
Go deeper: What to keep when she leaves
Some records must stay for a time. A tax invoice is one example. Fraud logs may be another. Keep them apart from the normal data, with few people allowed to read them. Remove her name where you can. Delete them when the period ends. Ask a lawyer for the periods in your country.
🧪 Interactive lab — enable JavaScript to play with this one.
Check that "sign out everywhere" really ends old sessions with Logout Check. Then check the cookies of the session your login creates with Cookie Check.