A telephone number, when first issued, is associated with a particular device on a particular network. The association is administrative. The carrier records that this number belongs to this account; the account belongs to this customer; the customer is identified by the documents they presented at the time of opening.

The administrative association can be transferred. A customer may move the number to a new device, port it to a new carrier, or, on request to the carrier, have a new SIM issued for the same number. Each of these is a routine operation. The carrier processes them daily; the staff who handle them follow procedures that are designed for ordinary customer life.

What travels with the number when it moves is more than the ability to make and receive calls. The number has, over time, been registered against many accounts as the trusted point of verification: banks, email providers, social platforms, financial services, professional accounts. Each of those accounts, when it sends a verification message, sends it to the device that currently holds the number.

The implication is that whoever holds the number, at any given moment, has the keys to a substantial share of the principal's accounts. The principal who is unaware of a transfer continues to behave as if they have those keys; the new holder may simultaneously be using them. The discrepancy can persist for hours, sometimes days, before it is noticed and addressed.

The remedy is not, in most cases, to abandon the number, which would itself create discontinuities elsewhere. It is to consider, for the accounts where this matters, whether the phone number should remain the trusted route or whether something more deliberate should be put in its place. Modern accounts increasingly support alternatives that do not depend on the carrier; the question is which ones, configured how, and with what fallback when something interrupts the primary path.