A marketing manager resigns in March. The handover is thorough: documents transferred, passwords moved into the company vault, access reassigned to a colleague. Everyone signs off and the offboarding checklist is marked complete.
In July somebody needs to change the payout account on a platform the company has used for four years. The login works. Then the platform asks for the code it has just sent to the number on file, and that number belongs to a person who stopped working there in March.
Why this surfaces at the worst possible time
The failure is dormant by nature. An account with a stale recovery number behaves normally for months. Everything works except the one class of operation that triggers a verification check, and that class is short and predictable: changing bank details, adding or removing a user, resetting a password, responding to a security flag, moving a domain. Those are the things you do under time pressure, usually because something else has already gone wrong.
Teams that have been through this once stop treating the number as an employee’s contact detail and start treating it as company infrastructure — a line the business controls, attached to a role rather than a person. Some buy a dedicated prepaid SIM and leave it in a drawer in the office. Others use a service such as SMS-Act to hold a number the company keeps regardless of who is on staff. The mechanism matters less than the principle: whoever can receive the code can take the account.
A phone number is not a contact detail
Most companies file phone numbers under contact information, next to the office address and the support line. Platforms do not treat them that way. To a platform, a registered number is a credential — often the strongest one, because it survives a forgotten password and outranks the email address in recovery flows.
That mismatch is the whole problem. The number is entered once, by whoever happened to be setting up the account that afternoon, and then it sits in a field nobody reviews. Password policy gets audited. Number ownership does not.
Where it bites hardest
Payment and payout accounts. Changing where money lands is the single most protected operation on any platform, and it is almost always gated behind a code sent to the registered number. If that number is gone, you are in a manual identity-recovery queue measured in weeks.
Advertising accounts. These accumulate history, audiences and spend limits that cannot be recreated. Losing access is not a matter of opening a new one.
Marketplace and seller accounts. Seller status is tied to trading history and reviews. A locked seller account during a peak season is a revenue event, not an IT ticket.
Domain registrars and DNS. The quietest one and the most damaging. Losing control here can take the website, the mail and every service authenticated against that domain.
Cloud and infrastructure consoles. Billing sits here, and so does the ability to spin resources up or shut them down. Recovery on these accounts is deliberately slow, because the provider has no way to tell an ordinary lockout from someone trying to seize a production environment.
The pattern across all five is the same. They are accounts a company touches rarely and depends on completely, which is exactly the combination that keeps a stale recovery number invisible until the day it matters.
Three fixes that do not work
The first is asking the former employee for the code. It works exactly as long as the relationship stays cordial and the person still has the number. Both are outside your control, and the arrangement quietly makes them a permanent dependency of your business.
The second is an internet calling number. Platforms run a lookup on the line type and reject the ones they can identify as non-carrier, because those are cheap to create in bulk. The screen usually still says a code was sent, which is why people spend an afternoon convinced they have found a bug.
The third is putting the founder’s personal number on everything. This solves the departure problem by concentrating it. Every account now depends on one handset, one SIM and one person who might be unreachable, travelling, or in the middle of changing carriers.
What this does not fix
Controlling the number closes one specific gap and nothing else.
Anything that establishes identity stays exactly where it was. Company registration documents, a director’s ID check, proof of address, beneficial ownership declarations, bank onboarding under anti-money-laundering rules — none of that becomes easier because the verification code now arrives at a number the company owns. Regulated finance is designed to be difficult at that gate, and it should be.
Nor does it entitle anyone to an account they are not otherwise allowed to hold. If a platform requires a registered local entity, having a local number without the entity is a terms violation, and enforcement tends to take the account and everything attached to it.
The handover item nobody writes down
Write down which number is registered on which account. The list is usually shorter than people expect and almost always contains at least one surprise.
Move the important ones onto a number the company controls, before anybody resigns. Doing it calmly takes minutes per account; doing it after a departure means identity recovery.
Attach the number to a role, not a person, and record who currently holds it. Then add one line to the offboarding checklist, immediately after the password vault entry: confirm this person’s number is not the recovery method on any company account.
Check the list again whenever somebody changes carrier. A number that is ported keeps working; a number that is abandoned and later reissued to a stranger does not, and nothing notifies you either way.
The short version
Offboarding processes are built around passwords because passwords are what companies think of as credentials. The phone number is treated as an address-book field, so it never gets handed over.
Then somebody needs to change a bank detail in July, and the code goes to a person who left in March. It is a small piece of administrative hygiene standing between a company and a recovery process that can take weeks.