When a Phone Number Becomes an Identity

SIM registration, recycled numbers, and account access in the Kurdistan Region of Iraq

KEY FINDING  The Kurdistan Region’s 2008 telecommunications-misuse law required mobile cards to be registered in the name of their rightful holder. Eighteen years later, the federal regulator temporarily stopped SIM sales through agents in the Region after receiving complaints that lines had been registered in citizens’ names without their knowledge. (Kurdistan Parliament, 2008, Art. 6; CMC, 10 Aug. 2026)

A phone number is now more than a contact detail

A mobile number begins as a telecommunications resource, but it often becomes a practical key to a person’s digital life. Banks, messaging apps, social networks, and government programmes use it to send one-time passwords, security alerts, and account-recovery messages. FIB, for example, begins digital account opening with a phone number and a six-digit code sent by SMS or WhatsApp, before checking an identity document and facial scan. (FIB, n.d.) The number is therefore not the whole legal identity, but it can be the first gate to it.

This matters at community scale. The KRG reported that 922,000 public-sector beneficiaries were paid through MyAccount in August 2026, while the programme’s privacy notice lists telephone numbers among the personal information it may collect during registration. (KRG Ministry of Finance and Economy, 17 Aug. 2026; MyAccount, n.d.) The more services that rely on a number, the greater the disruption when the number’s user, registered owner, and digital-account holder are no longer the same person.

Registration rules exist, but ownership can still drift

The KRI’s Law No. 6 of 2008 treats telephone and electronic communications as private and requires telecom companies operating in the Region to register mobile cards and communication devices in the name of the person who actually holds them. It also requires companies to provide subscriber information to a competent court when requested and allows large fines for non-compliance. (Kurdistan Parliament, 2008, Arts. 1 and 6)

Current registration procedures are more data-intensive than they were in 2008. A KRI seller’s published guidance asks residents for a national or civil-status ID, residence card, live photograph, and biometric fingerprint; Zain’s electronic-documentation description likewise refers to fingerprints, photographs, and identity documents. (Fastlink, n.d.; Zain Iraq, n.d.-a) These controls can establish who registered a line, but they cannot by themselves guarantee who will use it every day.

Formal transfer procedures try to close that gap. Asiacell requires the existing and new owner to appear at a main shop with identity documents; Zain similarly requires both parties, documents, and a main-shop visit. (Asiacell, n.d.-a; Zain Iraq, n.d.-b) If a SIM is simply handed to a relative, employee, buyer, or friend, the telecom record may remain attached to the old owner. That creates an attribution problem for the registered owner and a recovery problem for the real user.

The August 2026 intervention shows that the mismatch is not theoretical. The CMC temporarily restricted SIM sales in the KRI to operators’ main centres after recording complaints and indicators that lines were being registered in citizens’ names without their knowledge or consent, citing possible legal, financial, and social harm. (CMC, 10 Aug. 2026)

Abandonment and recycling move the number-but not every account

Prepaid numbers are not necessarily permanent. Zain’s published prepaid conditions say the company may stop service after the recharge and grace periods it sets and may retrieve and resell a number when the subscriber does not use it for a specified period. (Zain Iraq, n.d.-c, cl. 14) In June 2026, Shafaq News reported accounts from Iraqi users who said former numbers had been reassigned while still connected to messaging or social-media accounts; a CMC spokesperson told the outlet that a 2020 policy was intended to prevent reassignment of numbers linked to active digital accounts. (Shafaq News, 4 June 2026)

A recycled number does not automatically reveal an old WhatsApp chat history. WhatsApp says that a new holder who sees the number already registered can verify it with their own information and that the previous holder does not gain access to the new holder’s account or conversations. However, WhatsApp also warns that contacts may misidentify an account because mobile operators recycle numbers, and it provides a Change Number feature to move account information before the old number is lost. (WhatsApp, n.d.-a; WhatsApp, n.d.-b)

Other services can still expose a meaningful weakness: they may treat possession of the SIM as proof that the person requesting a code is the account holder. Asiacell, for example, describes an SMS PIN sent to the registered number as ensuring that “only you” can view recent usage history. (Asiacell, n.d.-b) That statement is secure only when the registered owner, daily user, and current SIM holder are the same person.

The Korek crisis made account dependency visible

On 19 August 2026, the CMC urged Korek users to add another licensed Iraqi number and alternative recovery methods-such as email or an authenticator app-to accounts that rely on Korek SMS for login or recovery. (CMC, 19 Aug. 2026; Rudaw, 19 Aug. 2026) On 26 August, Rudaw reported that a Baghdad court had removed an injunction blocking the regulator’s suspension measures, while the dispute remained contested by Korek. (Rudaw, 26 Aug. 2026)

This episode demonstrates a wider principle: a person can remain legally and socially the same individual while losing the network path used to prove that identity online. The immediate harm may be account lockout; the next risks are missed bank alerts, failed recovery, impersonation, or codes reaching a later holder. These outcomes are consistent with the local cases reported by Shafaq News and the regulator’s own urgent precautionary advice. (Shafaq News, 4 June 2026; CMC, 19 Aug. 2026)

What should change

• For users: verify at a main operator centre that every SIM you use is registered in your name; complete a formal ownership transfer instead of simply exchanging the card. Before abandoning a number, update WhatsApp, email, social media, banking, and government-service records, then test the new recovery methods. (Asiacell, n.d.-a; Zain Iraq, n.d.-b; WhatsApp, n.d.-b)
• For account security: reduce dependence on SMS by enabling an authenticator, passkey, recovery email, and saved recovery codes wherever available. WhatsApp provides two-step verification and passkeys, while the CMC gave the same broad advice to Korek users. (WhatsApp, n.d.-c; WhatsApp, n.d.-d; CMC, 19 Aug. 2026)
• For operators and the regulator: provide a simple service showing every number registered under a citizen’s identity; issue a consent receipt for each new SIM; publish inactivity, warning, quarantine, and recycling periods; and create a rapid process to correct unauthorized registrations and ownership mismatches. The August 2026 sales restriction already recognises the need for stronger electronic verification. (CMC, 10 Aug. 2026)
• For banks, platforms, and KRG services: treat a phone number as a contact channel and possession factor-not as identity by itself. High-risk recovery should require another factor or renewed KYC, and users should be able to replace a number without losing the underlying account.
• For legal protection: modernise the framework around correction, deletion, retention, breach notification, and redress. The KRI still lacks a comprehensive data-protection law, while the CMC consumer regulation mainly provides complaint routes, timelines, and escalation through the free number 177. (Freedom House, 2024; CMC, 2025)

Conclusion. The 2008 law correctly identified the rightful holder as the person to whom a SIM should be registered. (Kurdistan Parliament, 2008, Art. 6) The CMC’s 2026 interventions show that registration is only the beginning. (CMC, 10 Aug. 2026; CMC, 19 Aug. 2026) Protection must cover the number’s full life cycle-from sale and sharing to transfer, inactivity, recycling, and final removal from digital accounts. A phone number should help route communication; it should not quietly become a permanent master key to a person’s identity.

References

All links were checked on 27 August 2026. Arabic and Kurdish titles are translated or described in English for accessibility.

Asiacell. n.d.-a. Changing Ownership. https://www.asiacell.com/en/personal/services/other-services/changing-ownership

Asiacell. n.d.-b. How to top up or recharge your phone in one easy step (includes ‘My Pocket’ SMS verification). https://www.asiacell.com/en/blog/products-and-services/top-up-recharge-phone

Communications and Media Commission (CMC). 2025. Regulation on Consumer Protection [Arabic]. https://cmc.iq/ar/wp-content/uploads/2025/03/Regulation-on-consumer-protection.pdf See complaint duties, service-cutoff complaints, confidentiality, and Voice of the Consumer 177.

CMC. 10 Aug. 2026. Immediate suspension of mobile-SIM sales through agents in the Kurdistan Region pending electronic verification [Arabic]. https://cmc.iq/2026/08/10/%D8%A3%D8%A8%D9%88-%D9%83%D9%84%D9%84-%D9%8A%D8%B5%D8%AF%D8%B1-%D8%A3%D9%85%D8%B1%D8%A7%D9%8B-%D9%81%D9%88%D8%B1%D9%8A%D8%A7%D9%8B-%D8%A8%D8%A5%D9%8A%D9%82%D8%A7%D9%81-%D9%85%D8%A8%D9%8A%D8%B9%D8%A7/

CMC. 19 Aug. 2026. Warning to Korek users to add alternative numbers before verification messages stop [Arabic]. https://cmc.iq/2026/08/19/%D9%87%D9%8A%D8%A3%D8%A9-%D8%A7%D9%84%D8%A5%D8%B9%D9%84%D8%A7%D9%85-%D9%88%D8%A7%D9%84%D8%A7%D8%AA%D8%B5%D8%A7%D9%84%D8%A7%D8%AA-%D8%AA%D8%AD%D8%B0%D8%B1-%D9%85%D8%B3%D8%AA%D8%AE%D8%AF%D9%85%D9%8A/

Fastlink. n.d.. Required Documents to Purchase a SIM Card in the Kurdistan Region of Iraq. https://fast-link.com/sim-card-documents-kurdistan

First Iraqi Bank (FIB). n.d.. How to Create an Account. https://fib.iq/how-to-create-account/

Freedom House. 2024. Freedom on the Net 2024: Iraq. https://freedomhouse.org/country/iraq/freedom-net/2024 See sections on SIM registration and the absence of comprehensive privacy/data-protection laws.

Kurdistan Parliament. 2008. Law No. 6 of 2008: Preventing Misuse of Communications Equipment in the Kurdistan Region of Iraq [Kurdish]. https://legislation.krd/law-detail/?id=1774

KRG Ministry of Finance and Economy. 17 Aug. 2026. Over 920 Thousand Public-Sector Beneficiaries Are Paid Through MyAccount. https://gov.krd/mofe-en/activities/news-and-press-releases/2026/august/over-920-thousand-public-sector-beneficiaries-are-paid-through-myaccount/

MyAccount. n.d.. Privacy Policy. https://myaccount.gov.krd/en/privacy-policy/

Rudaw. 19 Aug. 2026. Iraq Telecom Regulator Urges Korek Users to Secure Backup Numbers for Account Access, Recovery. https://rudaw.net/english/categories/iraq/1078904

Rudaw. 26 Aug. 2026. Baghdad Court Clears Way for Suspension of Korek Operations. https://rudaw.net/english/categories/iraq/1078999

Shafaq News. 4 June 2026. Recycled Phone Numbers Raise Privacy Concerns in Iraq. https://shafaq.com/en/society/Recycled-phone-numbers-raise-privacy-concerns-in-Iraq

WhatsApp. n.d.-a. About Seeing Your Phone Number Already in WhatsApp. https://faq.whatsapp.com/3347469605523961

WhatsApp. n.d.-b. About Changing Phone Numbers. https://faq.whatsapp.com/1166321223998129

WhatsApp. n.d.-c. About Two-Step Verification. https://faq.whatsapp.com/1278661612895630

WhatsApp. n.d.-d. Create a Passkey. https://faq.whatsapp.com/1850567238795036

Zain Iraq. n.d.-a. Implementation of Electronic Documentation in Collaboration with the CMC. https://www.iq.zain.com/en/zain-iraq-starts-the-implementation-of-its-new-e-documentation-service-in-collaboration-with-cmc

Zain Iraq. n.d.-b. Ownership Transfer Service. https://www.iq.zain.com/en/services/ownership-transfer-service-

Zain Iraq. n.d.-c. Conditions of Prepaid Service Ownership. https://web-api.iq.zain.com/storage/app/media/en-ar-conditions-of-prepaid-service-ownership1.pdf Clause 14 addresses disconnection, retrieval, and resale after inactivity.