Old Apps, Forgotten Accounts and Your Exposed Phone Number: A Practical Privacy Guide for India

Photo by William Hook on Unsplash

TL;DR

• Every app or website you signed up for — even years ago — still stores your phone number and email address.
• Unused accounts are frequently less protected than active ones and are a common starting point for data breaches and identity misuse.
• In India, a mobile number left unused for roughly 90 days can be reassigned to a new subscriber, meaning your OTPs and login resets could reach a stranger.
• You can reduce your digital exposure by auditing your old accounts, revoking unnecessary permissions, and checking where your phone number and email currently appear online.

👉 See if your data's already leaked — free 30-second check →

Think about the last time you downloaded a food-delivery app for a single order, registered on a job portal for one application, or signed up on an e-commerce site for a one-off sale. You filled in your name, mobile number and email — and then never opened the app again. That account is almost certainly still active, still holding your personal information, and still sitting in a database that could be breached, sold or scraped at any point.

Most Indians have dozens of such accounts scattered across apps and websites they have long since forgotten. Together, these dormant sign-ups quietly build a digital footprint that is much larger — and more exposed — than most people realise. This guide explains why these old accounts are a genuine privacy risk, what makes the Indian context particularly sharp, and what practical steps you can take to shrink your exposure.

Why Old and Unused Accounts Are a Real Privacy Risk

It is tempting to think that an account you no longer use is harmless. In practice, the opposite is often true.

They are less protected by design

Old accounts are typically less protected than current ones. Many were created before stronger security measures such as multi-factor authentication became standard, and they often carry weak or reused passwords that have never been updated. When a data breach occurs at any of the services where you hold an old account, attackers can use the leaked credentials to attempt logins on your active accounts elsewhere — a technique known as credential stuffing.

You will not notice when something goes wrong

Because you no longer log in, you are unlikely to see warning signs such as login alerts, password-change notifications or unusual activity. By the time you find out, the damage may already be done.

Apps continue collecting data even after you stop using them

Unused apps installed on your phone may continue to run background processes and collect data long after you last opened them. Outdated apps that are no longer receiving security patches from developers present additional vulnerabilities that attackers can exploit.

One weak account can compromise stronger ones

Some services allow password resets through a linked email address or mobile number. A forgotten account that shares your email or phone with a more important account can become a back door into your banking, UPI or social media logins.

Why the Risk Is Especially Sharp in India

Your phone number is the master key to your digital life

In India, your mobile number is linked to almost everything: your Aadhaar, UPI handles, bank accounts, income-tax e-filing, EPFO UAN, insurance policies, demat accounts and social-media logins. Every time you signed up for a new app using your primary number, you gave that service a key that unlocks far more than just the app itself.

As one observer has noted, your phone number has effectively become a commercial asset handled by a large and not always well-regulated ecosystem of marketers, data brokers and, in the worst cases, outright scammers. Sharing it indiscriminately — even with legitimate-seeming apps — adds to a cumulative exposure that is difficult to walk back.

The recycled mobile number problem

There is an additional risk that is specific to India. Under TRAI norms, a mobile number that remains unused or unpaid for roughly 90 days can be deactivated by your telecom operator and, after a short quarantine period, reassigned to an entirely new subscriber. If your old number is still linked to your bank, Aadhaar, UPI, email, DigiLocker or EPFO account, whoever receives that number next could receive your OTPs and reset your logins without any technical trickery on their part.

Social media accounts are particularly vulnerable here. Platforms such as WhatsApp allow account recovery based purely on the SIM. If you have not enabled two-step verification, a new holder of your old number can simply install WhatsApp and inherit your account.

India's new data protection law gives you new rights

India's Digital Personal Data Protection Act, 2023, operationalised through the DPDP Rules notified by MeitY on 13 November 2025, now gives Indian residents formal rights over their personal data. Under these rules, consent must be specific, informed and easy to withdraw, and collection of data beyond what is necessary for a declared purpose is no longer permitted. Importantly, certain categories of platforms — including e-commerce sites, online gaming intermediaries and social-media services with significant Indian user bases — are now required to delete personal data within a set period if a user does not actively maintain their account.

This means you now have a legal basis to request deletion of your data from platforms you no longer use. Exercising that right, however, requires knowing which platforms hold your information in the first place.

How Your Phone Number and Email End Up Exposed

Personal data does not simply stay inside the app you gave it to. Here are the most common routes by which your phone number and email address travel beyond your control:

• Data breaches: Any company storing your details can suffer a breach. When they do, your data often ends up in leaked databases that circulate on the open web or dark web, sometimes for years after the original incident.
• Third-party data sharing: Many apps share user data with advertising partners, analytics providers and affiliates. Each additional party that receives your data is another potential breach point.
• Scraped directories and people-search sites: Publicly available information — phone numbers listed on classifieds, business directories or social profiles — is routinely scraped and compiled into searchable databases.
• Permissions oversharing: Apps frequently request access to your contacts, which means your number may be collected not just when you register but also when someone else's phone, which has your number saved, is scanned by an app they install.
• Leaked marketing databases: Telemarketing lists are bought, sold and frequently leaked, placing Indian mobile numbers in the hands of people you never consented to share them with.

How to Audit and Clean Up Your Old Accounts

A practical account audit does not need to be complicated. Work through the following steps methodically.

Step 1: Check where your email address has been used

Your email address is the registration anchor for most online accounts. Search your inbox for phrases such as "welcome to", "confirm your account", "you have registered" and "your account has been created". Make a list of every service that appears. Pay particular attention to services you no longer recognise or no longer use.

You can also check whether your email address has appeared in known data breaches. Scan My Shadow scans your email address across more than 1,500 sources and produces a report of where it has been found, helping you understand your current level of exposure before you begin cleaning up.

Step 2: Check where your phone number has been used

Your Indian mobile number has likely been given to even more services than your email, because many apps require it for OTP-based registration. Search your SMS inbox for OTPs and verification messages from services you may have forgotten. Note every sender name.

You can also run a check on your phone number at Scan My Shadow to see which sources currently return results for your number across the open web and data-aggregation platforms.

Step 3: Review app permissions on your phone

• On Android: Go to Settings > Apps > Permissions and review which apps have access to your contacts, location, microphone, camera and storage.
• On iPhone: Go to Settings > Privacy & Security and review each permission category.
• Revoke permissions for any app that does not need them for its core function.
• Uninstall apps you have not used in the past three to six months.

Step 4: Delete or deactivate old accounts

For each service you identified in Steps 1 and 2, decide whether you still need the account. If you do not, log in and look for a Delete Account or Close Account option. If no such option is visible, email the company's support or privacy team requesting account deletion and erasure of your personal data. Under India's DPDP Act, certain categories of services are now obligated to respond to such requests.

Step 5: Delink your old mobile number

If you have changed your number or are using a number you no longer actively pay for, delink it from your bank accounts, UPI handles, Aadhaar-linked services, EPFO UAN, income-tax portal and DigiLocker before it is reassigned. This single step can prevent a stranger from receiving your OTPs after a number is recycled.

Step 6: Enable two-factor authentication on accounts you keep

For every account you decide to retain, enable multi-factor authentication. Use an authenticator app rather than SMS wherever possible, since SIM-based OTPs can be intercepted if your number is recycled or if you are targeted by a SIM-swap attempt. If you notice that your phone has suddenly lost network connectivity without explanation, contact your telecom operator immediately, as fraudsters sometimes obtain duplicate SIM cards to intercept OTPs.

Practical Habits That Reduce Long-Term Exposure

• Use a secondary email address for app sign-ups and online shopping, keeping your primary email for banking, government services and trusted contacts.
• Be selective about which apps get your real number. For one-off services, consider whether the app genuinely needs it.
• Review permissions once every three months. Set a reminder and go through your installed apps systematically.
• Check your digital exposure periodically. Your personal data landscape changes over time as new breaches occur and as old accounts resurface in leaked databases.
• Read app privacy policies before installing, or at least check what permissions the app requests before granting them. Be especially cautious of apps that request access to your contacts, as that can expose other people's data as well.

Find Out Where Your Phone Number and Email Are Exposed

Your personal data has been collected by dozens of apps and websites over the years. Some of those services have suffered breaches. Others share your information with third parties. And some of your old details may now appear in public directories you never consented to.

Scan My Shadow checks your phone number and email address across more than 1,500 sources and gives you a clear, plain-language report of where your personal information has been found. No guesswork. No generic advice. Just a factual picture of your current digital exposure so you can decide what to do next.

Check your digital exposure at Scan My Shadow →

Curious what's publicly visible about you right now? Try the free Digital Footprint Checker — it takes under a minute.