The Communications Authority of Kenya (CA) plans to set up a central database of recycled phone numbers to help banks, fintech firms and other service providers avoid sending messages to unintended recipients after mobile lines change ownership.
The database will list recently recycled numbers to enable third parties, such as bulk SMS platforms, to verify their status before sending subscription-related messages.
This is part of the regulator’s proposed rules that seek to give mobile subscribers more control over their lines by extending the window telcos take to recycle dormant numbers by three months.
It mirrors a similar system in the United States, where the Federal Communications Commission maintains a Reassigned Numbers Database that allows callers to check whether a phone number has been reassigned since a specified date.
“The Authority will establish a centralised database that will contain a list of numbers that have been recycled within a given period of time,” the CA said in response to public comments on the proposed line deactivation and recycling rules.
“Querying the database will ensure that third-party value-added service providers only send messages to the rightful owner.”
The proposal follows concerns over the security and privacy risks arising from the recycling of dormant mobile lines, which have become a key gateway to mobile banking, online accounts and identity verification through one-time passwords (OTPs).
A recycled number could leave banks, savings and credit co-operative societies (Saccos) and fintech providers sending account alerts or password-reset messages to a new subscriber rather than the original customer.
The proposed database would allow service providers to verify whether a number has changed ownership before sending subscription-related messages, reducing the risk of personal information being exposed to unintended recipients.
Telcos such as Safaricom and Airtel Kenya will be required to submit lists of deactivated and recycled numbers every three months to the centralised system to help third parties update their records.
But the regulator rejected a suggestion that subscribers should be required to notify their contacts by SMS when their mobile numbers change ownership, warning that such efforts could create fresh privacy concerns.
“It is a violation of the Data Protection Act to access personal information without authorisation,” the CA said.
Under the proposals, a line would become eligible for deactivation and recycling after three months without revenue-generating activity, including calls, SMS, data use, airtime top-ups or value-added services.
Operators would then be required to contact the subscriber and give them a further three months to reactivate the line.
Thirty days before the end of that period, they would publish lists of numbers due for deactivation through their websites, newspapers with nationwide circulation and other media.
Newly issued and recycled numbers would not receive marketing messages by default, while operators would have to remove recycled lines from previously opted-in business-to-consumer messaging services.
Before reallocating a number, telcos would also be required to delink and archive the previous owner’s personal data, ensuring it is not accessible to or inherited by the new subscriber.
The proposed safeguards come amid growing concern about the risks of recycling numbers that remain linked to former owners’ financial and digital accounts.
In March, the High Court barred telcos from automatically recycling inactive numbers without the original subscriber’s consent, following a challenge by an inmate whose line had been affected by prolonged involuntary inactivity.
The court cited the risk of privacy breaches where new users could access residual information linked to mobile banking, messaging platforms and online accounts.
The CA’s proposals provide special protection for prisoners and people held in remand for extended periods.
The Commissioner-General of Prisons would facilitate the exemption of eligible inmates from the inactivity window, including suspects denied bail who are likely to remain in remand for more than six months.
For telcos, the longer retention period and additional notification, reporting and data management requirements are expected to increase compliance costs.
Dormant lines generate no revenue but continue to occupy network resources, while the supply of numbering resources is limited.
