Stop using phone numbers as a primary key
Blog post from WorkOS
Phone numbers are presented as unreliable user identifiers because they belong to SIM cards rather than individuals, can be shared, reassigned by carriers, and may be automatically associated with multiple Google accounts signed into the same Android device under Android’s default phone-verification behavior. The text argues that database designs treating phone numbers as unique identity keys can cause registration conflicts, accidental account merges, and insecure account recovery, particularly when numbers are shared among family or work users or recycled to new subscribers. It cites FCC reassignment practices, research finding that many recycled numbers remain connected to online accounts, and NIST guidance that treats phone-based out-of-band authentication as restricted and recommends additional recovery factors. Instead, it recommends using stable internal user IDs and federated issuer-subject pairs for identity, while storing phone numbers as non-unique contact records with verification timestamps and provenance. Phone-based recovery should treat a number only as a signal, require independent factors such as passkeys or verified alternative channels, and reassess trust after events such as SIM changes, number ports, or device swaps.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.