Executive Summary
Nigeria’s SIM recycling system, the practice by which mobile network operators deactivate dormant phone lines and redistribute them to new subscribers, has evolved into a verifiable structural risk to the country’s financial, identity, and security ecosystems. This investigation, drawing on official NCC data, NIBSS fraud reports, court records, and regulatory filings, concludes that the risk is systemic rather than incidental.
As of early 2026, Nigeria had approximately 179.6 million active mobile subscriptions against a total allocated number pool of 382.94 million. The gap between active users and allocated numbers represents a growing reservoir of dormant SIMs subject to recycling. Under the NCC’s Quality of Service Business Rules 2024, a prepaid line with no revenue-generating activity for six months must be deactivated. NIN-linked SIMs can remain dormant for up to twelve months before qualifying for recycling. The result is a continuous churn of phone numbers, numbers that, in Nigeria’s tightly integrated digital economy, remain bound to Bank Verification Numbers (BVNs), OTP authentication systems, mobile wallets, WhatsApp accounts, and government identity records even after the SIM has been transferred to a new user.
The consequences documented in this report span five risk categories: financial security, identity and data leakage, criminal exploitation, social disruption, and systemic damage to digital trust. SIM swap fraud was identified as the second most prevalent fraud attack vector in Nigeria in 2024, accounting for 25 percent of all reported fraud methods (NIBSS 2024 Fraud Report). Electronic payment fraud losses reached ₦52.26 billion in 2024 before declining to ₦25.85 billion in 2025, a reduction partly attributed to BVN-NIN integration, but one that regulators warn may mask under-reporting.
The NCC launched the Telecoms Identity Risk Management System (TIRMS) platform in March 2026 and signed a landmark Memorandum of Understanding with the Central Bank of Nigeria in April 2026, the most significant institutional response to this crisis to date. Concurrently, the House of Representatives passed a resolution in April 2026 urging the NCC to extend the SIM reassignment threshold from six months to eighteen months. Both developments signal growing official recognition of the problem. Neither has yet resulted in enforceable safeguards.
Key Finding
SIM recycling creates a systemic vulnerability in Nigeria’s telecom-banking ecosystem. The principal risk is not incidental inconvenience but verified financial identity exposure: new owners of recycled numbers can, and in documented cases, do- receive bank OTPs, fraud alerts, and identity-linked messages intended for prior users, with no mandatory delinking protocol currently in force.
SIM Recycling in Nigeria
SIM card recycling is a globally practised but locally consequential telecommunications process. When a mobile line remains inactive, generating no calls, SMS, data usage, or airtime recharge, for a defined period, the operator deactivates and reclaims the associated number. The number is then returned to inventory and issued to a new subscriber. For operators, this is an economic imperative: the NCC charges fees based on allocated numbering resources, making dormant lines a direct financial liability.
Why Nigeria Is Different
In most jurisdictions, recycled numbers carry limited risk because phone numbers are not identity anchors. In Nigeria, they are. The NCC’s SIM registration requirements, first introduced around 2010–2011 and progressively tightened to require NIN linkage, have made the mobile number a de facto identity credential. It authenticates banking transactions, unlocks digital wallets, verifies BVNs, and serves as the entry point for government services. When that number is handed to a new user without severing its legacy digital ties, the new owner is, in effect, given a partial key to someone else’s financial and identity architecture.
Nigeria’s emigration wave compounds this structural problem. The ‘Japa‘ phenomenon, the broad-based departure of educated Nigerians seeking opportunities abroad, resulted in more than one million emigrants in 2024 alone. These individuals frequently leave their Nigerian SIMs dormant without formally delinking their bank accounts or digital services. Under current NCC rules, their numbers can be recycled and assigned to new users without those users’ knowledge of the digital liabilities they are inheriting.
Regulatory Framework
NCC Deactivation and Recycling Policy
The Nigerian Communications Commission’s Quality of Service Business Rules 2024 formalise a six-month inactivity threshold for prepaid SIM deactivation. A separate provision allows NIN-linked SIMs to remain dormant for up to twelve months before entering the recycling cycle. In practice, the four major operators — MTN, Airtel, Globacom, and 9mobile, have historically applied varying thresholds, with some operators applying periods as short as three months.
The NCC’s Telecom Identity Risk Management Policy (TIRMP), updated in 2024, enables re-assignment of dormant lines after 365 days without any revenue-generating event. NCC Executive Vice Chairman Aminu Maida confirmed these parameters at a virtual stakeholder meeting in April 2025.
Key Regulatory Gaps
- No mandatory cooling-off quarantine period exists to block OTPs or bank alerts after a number is recycled, per NCC 2024 review findings reported by BusinessDay.
- No public registry of recycled numbers existed as of the February 2026 NCC consultation paper.
- Rules for purging prior NINs from recycled SIMs are inconsistently enforced, per the same 2024 NCC review.
- Third-party SIM registration was banned in August 2025, but the NCC fined one operator ₦104 million for continued infractions at Kano-based registration points, indicating informal markets persist.
The TIRMS Initiative (2026)
In response to mounting evidence of SIM-linked fraud and identity theft, the NCC unveiled plans for the Telecoms Identity Risk Management System (TIRMS) at a stakeholder forum in Abuja in March 2026. TIRMS is designed as a cross-sector platform enabling telecom operators, banks, securities regulators, the National Identity Management Commission (NIMC), and security agencies to query, in real time, whether a phone number has been recycled, swapped, or flagged for suspicious activity.
On 20 April 2026, the NCC and the Central Bank of Nigeria signed a Memorandum of Understanding formalising the TIRMS portal and inaugurating two joint committees: the Joint Committee on Payment Systems and Consumer Protection, and the Joint Committee on the TIRMS Portal. NCC Director of Cybersecurity and Internet Governance Olatokunbo Oyeleye described digital trust as “the operating licence of the modern economy.”
MTN Nigeria raised concerns at the TIRMS consultation, warning that low bank adoption of similar existing real-time notification systems suggests TIRMS could become another underutilised tool without mandatory regulatory integration requirements, a warning that points to the limits of voluntary compliance in resolving this crisis.
Legislative Response
In plenary on 28 April 2026, the House of Representatives unanimously adopted a motion by Hon. Billy Osawaru (Edo State) urging the NCC to extend the dormancy threshold for SIM reassignment to a new baseline of eighteen months. Within that window, operators would be required to publish numbers slated for reallocation in national newspapers and notify law enforcement agencies at least twice annually. The resolution was reported by Premium Times, Vanguard, and BusinessDay.
The resolution cited the Nigeria Data Protection Act 2023 and highlighted documented cases of wrongful criminal exposure tied to recycled numbers. The House mandated its Committees on Communications and Commerce to engage the NCC and the Nigeria Data Protection Commission, with a report-back deadline of four weeks.
As of the date of this publication, the resolution carries the force of a legislative recommendation, not a binding amendment to NCC regulations. The outcome of committee engagement with the NCC has not been publicly confirmed.
The Numbers: Subscriber Data and Fraud Statistics
Telecom Subscriber Landscape
NCC Industry Statistics for February 2026 record 179.64 million active mobile subscriptions against a total allocated number pool of 382.94 million. The gap implies that over 200 million allocated numbers are in some state of dormancy, suspension, or recycling inventory at any given time. As of March 2026, GSM subscriptions stood at approximately 182 million, led by MTN (94.2 million, 51.78%), Airtel (62.0 million, 34.09%), Globacom (22.5 million, 12.34%), and 9mobile (3.3 million, 1.79%).
In September 2024, active subscriptions fell to approximately 154.9 million following the deactivation of over 42 million SIM cards that failed NIN compliance. No official dataset publicly quantifies the precise number of recycled SIMs issued to new users in any given period, a significant gap in the evidentiary record.
Fraud Statistics
According to NIBSS data presented at the NeFF Forum in January 2026, electronic payment fraud losses in 2025 totalled ₦25.85 billion, down 51% from ₦52.26 billion in 2024. The 2024 figure was substantially distorted by a single ₦31.1 billion incident involving one institution.
The NIBSS 2024 Fraud Report identified SIM swap fraud as the second most prevalent attack vector, accounting for 25% of all fraud methods, behind phishing at 31%. Identity theft and credential compromise accounted for a further 21%.
The FITC Q1 2025 Report recorded a 602.98% surge in fraud losses to ₦3.29 billion in the first quarter of 2025 compared to Q1 2024, while case volume rose only 7.63%. This points to a shift from high-volume, low-value attacks to targeted, high-impact operations, a pattern consistent with deliberate exploitation of recycled SIM vulnerabilities.
NIBSS also flagged a 34% drop in institutional fraud reporting in Q4 2025, explicitly warning that this decline may mask the true scale of losses rather than reflect genuine improvement.
BVN Integration and the Structural Gap
As of December 2025, 67.8 million BVNs had been registered, up from 51.9 million in 2021. The CBN’s BVN policy update, effective 1 May 2026, introduced a single lifetime phone number update limit per BVN, new device verification requirements, and fraud watchlist integration.
NIBSS acknowledges that BVN-NIN integration, while cited as the primary driver of the 51% reduction in aggregate fraud losses in 2025, verifies identity at onboarding only. It does not monitor the post-onboarding integrity of the phone number used for ongoing transaction authentication. This is the structural gap that TIRMS is specifically designed to address.
Documented Cases
The following cases are drawn from verified public records, court documents, and credible journalism with named sources and institutional corroboration. Two cases are fully verified. Two further cases reported by BusinessDay, a Lagos forex trader and an Ibadan civil engineer, were not independently confirmed through court records, police case numbers, or institutional responses, and are not included in this report.
Case 1: Anthony Okolie vs. DSS, MTN, and Hanan Buhari (2019–2020)
On 19 July 2019, Anthony Okolie, a trader from Delta State, was arrested by the Department of State Services (DSS) and detained for ten weeks without charge. Okolie had legally purchased an MTN SIM card that MTN had recycled after it was abandoned by Hanan Buhari, daughter of then-President Muhammadu Buhari. The SIM had lain dormant for over two years before being returned to market. Okolie possessed valid purchase documentation.
The Federal High Court in Asaba awarded Okolie ₦10 million in damages, payable by the DSS, for the violation of his fundamental human rights. Charges against Hanan Buhari and MTN were struck out for insufficient evidence. The case established in judicial record that recycled SIMs can directly cause the unlawful detention of innocent users.
Sources: Sahara Reporters (January 2020), Premium Times (February 2020), Economic Confidential (June 2025). Court record: Federal High Court, Asaba, Suit No. FHC/ASB/CS/3/2020.
Case 2: Ibrahim Mariam Titilayo, NYSC Corps Member, Akure (October 2025)
On 16 October 2025, plainclothes officers from the Force Intelligence Department (FID) arrived at the home of Ibrahim Mariam Titilayo, a 24-year-old NYSC corps member, in Akure. Officers seized her iPhone 12 Pro Max, an Itel phone, and her WiFi router, alleging ties to a January 2024 kidnapping and murder case. The link was traced to an Airtel SIM she had purchased approximately six months earlier, a SIM previously owned by a person under investigation.
Titilayo was detained overnight under threat of transfer to Abuja. Her release came only after intervention by rights activist Omoyele Sowore and legal support from Barrister Tope Temokun. Airtel subsequently confirmed, in writing, the clean activation date of the SIM, establishing definitively that Titilayo had no connection to the prior owner’s activities. No formal institutional review of the FID’s procedure was publicly announced.
Sources: BusinessDay (November 2025, reporter Royal Ibeh), Punch Newspapers (October 2025). Corroborated by Airtel’s written confirmation of SIM activation date and by legal representation from Barrister Tope Temokun.
Risk Landscape
Financial Security
Most Nigerian banks and digital platforms rely on SMS-based OTPs for verifying logins and authorising transactions. When a SIM is recycled to a new user, that user begins receiving all SMS messages directed to the number, including OTPs, bank alerts, and account recovery codes from the prior owner’s linked services. Malicious actors who deliberately acquire recycled numbers for this purpose can drain accounts before the original holder detects anything is wrong.
Security expert Adegoke, writing in The Guardian Nigeria in April 2026, proposed that banks be mandated to treat newly recycled numbers as high-risk, triggering temporary freezes on high-value USSD transfers and requiring enhanced re-verification before any sensitive transaction is approved. No such mandatory protocol currently exists.
The CBN’s May 2026 BVN update, limiting each BVN to a single lifetime phone number change, is itself an institutional acknowledgement that SIM-based authentication has become a primary exploitation vector.
Identity and Data Leakage
Beyond OTP interception, SIM recycling enables WhatsApp account takeover. The platform automatically links accounts to phone numbers; a new owner of a recycled SIM who inserts it into a device can trigger WhatsApp resynchronisation, potentially accessing the prior user’s message history, contacts, and media if two-factor authentication was not enabled.
BVN-SIM mismatches represent a specific sub-risk: where a number remains registered to a BVN but the physical SIM has been recycled, authentication systems may pass fraudulent transactions because the number-BVN link appears valid, even though the number is no longer under the BVN holder’s control. TIRMS is designed to flag this condition in real time, but its mandatory adoption by banks has not yet been legislated.
Criminal Exploitation
NATCOMS President Adeolu Ogunbanjo personally visited 12 Lagos SIM registration points and found agents registering SIMs with arbitrary details. The NCC has identified 2.2 million ‘bad SIMs’ nationwide, with 95.7 million invalid SIM registrations historically logged. The NCC fined one operator ₦104 million for infractions at Kano-based registration points following its August 2025 ban on third-party SIM registrations.
The two verified cases in this report, Okolie (2020) and Titilayo (2025), demonstrate that innocent purchasers of recycled numbers can face criminal investigation, detention, and reputational harm through no fault of their own.
Social and Communication Disruption
Recycled numbers disrupt personal and professional communication networks. Contacts of the prior owner, family members, employers, or business partners may continue sending messages or making calls to numbers now in the hands of unrelated users. No official dataset currently tracks the volume of misdirected communications attributable to SIM recycling, and this remains a gap in the official record.
Systemic Digital Trust
NCC Executive Vice Chairman Aminu Maida stated at the March 2026 TIRMS forum that fraudulent activities involving recycled, swapped, churned, and barred SIMs have become a major channel for identity theft and financial crimes, “undermining confidence in digital systems.” The NIBSS warning about under-reporting, following the 34% Q4 2025 drop in institutional fraud reporting, adds a further dimension: the true scale of trust erosion may not yet be fully visible in official data.
Global Context
SIM recycling is a universal telecoms practice, but its risk profile varies significantly by the degree to which phone numbers are integrated into national identity and financial systems.
The Central Bank of Kenya’s Financial Sector Stability Report 2024 recorded losses of Sh1.59 billion ($12 million) to fraud in 2024, nearly quadruple the prior year, with SIM swap schemes among the primary vectors. Bank of Ghana 2024 data recorded 16,733 fraud cases that year; the Ghana Chamber of Telecommunications called for deeper institutional collaboration in April 2026, though no signed cross-sector agreement existed as of that date.
Nigeria stands out in the African context for having made the most advanced institutional response to SIM recycling risks through the TIRMS initiative and the NCC-CBN MOU. The United States FCC operates a Reassigned Numbers Database allowing service providers to query whether a number has been reassigned, the TIRMS portal is designed to serve a comparable function, though access is restricted to regulated entities rather than open to public query.
Conclusions and Policy Implications
This investigation finds that SIM recycling in Nigeria constitutes a verified systemic risk to financial identity, security, and digital trust, not merely an operational inconvenience.
Principal Findings
- The structural vulnerability is confirmed. BVN-NIN integration verifies identity at onboarding but cannot detect post-onboarding changes to the phone number used for authentication. TIRMS is designed to fill this gap but remains contingent on adoption by financial institutions.
- Documented human harm is real. Two independently verified cases, one culminating in a Federal High Court monetary award, establish that SIM recycling causes unlawful detention, financial loss, and reputational injury to innocent new SIM owners.
- Regulatory response is progressing but incomplete. The NCC-CBN MOU (April 2026) and the House of Representatives resolution (April 2026) represent meaningful institutional movement. Neither yet constitutes enforceable consumer protection.
- A critical data gap persists. No official public dataset quantifies the annual volume of recycled SIMs reassigned to new users, the frequency of OTP misdelivery, or the number of individuals who have suffered financial loss directly attributable to SIM recycling. This limits the ability to fully quantify aggregate risk.
- The emigration factor is a growing variable. The ‘Japa’ wave, over one million emigrants in 2024 alone, systematically generates dormant SIMs attached to active financial identities, increasing the volume of high-risk recycling candidates over time.
Policy Implications
- Mandatory delinking protocols. Before any SIM is recycled, operators should be required to initiate a system-wide notification and delinking process across NCC, CBN, NIMC, and financial institutions.
- Cooling-off quarantine with OTP blocking. A mandatory buffer period, independent expert recommendations range from 30 to 90 days, during which the recycled number cannot receive bank OTPs or authentication codes, would address the most acute financial security risk.
- Mandatory TIRMS adoption by banks. The effectiveness of the NCC-CBN MOU depends on financial institutions actually querying TIRMS before processing authentication events. Without a CBN directive mandating this, the system risks the kind of low uptake that MTN’s consultation submission warned against.
- Public recycled number registry. A searchable public record of recycled numbers, analogous to the US FCC’s Reassigned Numbers Database, would allow individuals and businesses to verify whether a number has recently changed hands.
- Extended dormancy window. The House of Representatives’ 18-month proposal addresses the frequency of recycling. Analysts note, however, that extending the window without mandatory delinking does not eliminate the risk, it delays it. Both measures are necessary.
English 
简体中文 
Čeština 
Deutsch (Sie) 
Français 
