Changing Your Mobile Number on Absher Takes an Identity Check. What Does It Take at Your Business?

Changing Your Mobile Number on Absher Takes an Identity Check. What Does It Take at Your Business?

The short answer: On October 6, 2026, Absher explained that changing your mobile number happens in its app in 5 steps, the last of which is biometric verification. At many businesses, by contrast, a customer's number changes with a WhatsApp message or a phone call. Yet in your system that number is not just a contact detail; it is the key to the account, where login codes, invoices and statements go. Change it without checking and you may hand the account to someone else. Leave it stale and your customer's invoices may reach a stranger. Article 22 of the Implementing Regulation of the Personal Data Protection Law requires verification, records and notification on every update.

How does Absher change a mobile number?

Absher published the steps on its official account on X. They start in the app, before logging in:

1. Select Digital Identity Management before logging in.
2. Select Change Mobile Number.
3. Enter your ID number and date of birth.
4. Enter the new mobile number, then select Change Mobile Number.
5. Complete biometric verification to confirm the change.

In an earlier reply to a user in January 2025, Absher explained that the in-app change is available if the new number is registered in your name; otherwise it is done through self-service machines or by visiting the registration and activation staff at Passports or Civil Affairs. The same menu shown in the service image also offers a Temporary Suspension of Digital Identity option.

Read the steps as a business owner and you will find three questions Absher answers before accepting a new number: who you are (ID number and date of birth), whether you really are the account holder (biometrics), and whether the new number is yours (registered in your name, or else verified in person). The published steps do not mention a code sent to the old number, so the check rests on the person, not on their previous phone. That makes sense, because someone changing their number has often lost the old one.

Your customer's mobile number is the key to their account

In many systems, from point-of-sale to online stores and loyalty programs, far more than contact hangs on the mobile number:

• Access: the verification code sent by text message is all a customer needs to get into their account.
• Money: wallet balance, loyalty points, and sometimes a credit limit.
• Documents: invoices, statements and quotations sent over WhatsApp.
• Collections: payment reminders and amounts due.

So the change fails in two ways. The first is changing it without checking: someone calls, says they are the customer and have a new phone, the employee updates the record, and the login codes now go to a fraudster, along with the balance and points. The second is never changing it: the customer drops their old line without telling you, and their invoices and statements keep going to a line that may now belong to someone else.

The old number may now belong to someone else

Phone lines do not stay with their owners forever. The Regulations for Number Portability between Fixed and Mobile Services issued by the Communications, Space and Technology Commission, as amended by decision 1-195-2025, state in clause 4-14 that when service on a ported number is cancelled, the provider retains it for 90 days, during which it may reissue it only to the same user, and then returns it to the provider it was originally allocated to. Clause 4-13 allows the provider to accept a user's assignment of their ported number to another user.

In practice: the line your customer abandoned months ago may not be theirs today, and a system that does not know this keeps sending to it. Holding stale contact data is not a minor admin slip; it is a door through which your customer's data can walk out to someone you do not know.

What does the PDPL Implementing Regulation require?

The Personal Data Protection Law was issued by Royal Decree No. M/19 dated 9/2/1443H, and its Implementing Regulation, published in Umm Al-Qura, sets out the data subject's right to request correction in Article 7. Article 22 defines correction as three types: correcting wrong data, completing incomplete data, or updating outdated data. A new mobile is the third type. When correcting, the controller, meaning your business, must do four things:

• Ensure the data is accurate and sound by checking supporting documents where necessary.
• Notify, without delay, the parties to whom the data was disclosed, such as a delivery company you share customer data with.
• Notify the data subject when the correction is complete.
• Document every update made to the data.

The same article adds that if the business finds the data is incorrect and this could harm the data subject, it must stop processing until the data is updated; that it must correct the data without delay once it learns it is outdated; and that it must review the accuracy and currency of data periodically.

Article 1 of the Regulation defines a personal data breach as any incident that leads to disclosure, damage or unlawful access to personal data, whether intentional or not. Article 24 requires notifying the competent authority within 72 hours of becoming aware of a breach if it could harm the data or the data subject. A statement sent to a line that has passed to someone else may fall within that definition; it is not just a lost message.

How do you change a customer's number without handing over their account?

• Never accept the change from the new number alone. A message from an unfamiliar phone saying it is so-and-so proves nothing. Ask for something that proves the requester is the customer.
• Match the check to what the account holds. For a customer with no balance and no credit, a code sent to the old number, if they still have it, may be enough. For an account with a balance, credit terms or sensitive data, verify through Nafath if your system is connected to it, or with ID in person at a branch, just as Absher sends people whose new line is not in their name to its machines and offices. We covered the integration in Nafath National SSO Integration.
• Notify both numbers. Send a confirmation to the new number, and a message to the old one saying the contact details changed and whom to call if they did not request it. That meets the data subject notification Article 22 requires, and alerts the real customer if the change was fraud.
• Hold sensitive actions after a change. A balance withdrawal, a new delivery address, or a large credit order in the first hours after such a change deserves human review before it goes through.
• Log every change. Who asked, who made it, the old and new mobile, the time, and the verification method. That is what Article 22 means by documenting updates, and it is the first thing you will need if a customer complains.
• Review numbers periodically. For messages that fail to deliver, and customers who have been inactive for a long time, ask them to confirm their number on their next interaction instead of assuming.
• Do not make the mobile number the customer's identity in your system. Give every customer a fixed internal ID, and make the mobile a field that can change. If the mobile is the identifier, changing it means rebuilding the account and its history, and a mistake costs more.

The Origami view

We read this service as a design lesson more than a news item. Absher did not make the change harder; it moved it into the app, but tied it to verifying the person, not the phone. Convenience and security do not conflict here: few steps, with the check in the right place.

When we build a system for a business, we treat a mobile number change as an operation with permissions, a log and notifications, not as editing a field on the customer screen. We give every customer a fixed internal ID, scale the verification to what the account holds, and notify both numbers automatically. This is part of what we offer through our services.

Conclusion

• Absher changes a mobile number in the app in 5 steps ending with biometric verification, and sends people without a number in their name to self-service machines or offices.
• In your system, the mobile number is the key to the account: login codes, balance and invoices.
• A cancelled ported number is held for its owner for only 90 days under the Communications, Space and Technology Commission's regulations, so do not assume the old number still belongs to your customer.
• Article 22 of the Implementing Regulation requires verification, records, and notifying both the customer and the parties you shared data with; Article 24 sets 72 hours to notify the competent authority of a harmful breach.
• Match the check to what the account holds, notify both numbers, log every change, and give each customer an internal ID that never changes.

For the full picture of your obligations, read our practical guide to the Personal Data Protection Law.

Sources

• Absher on X (October 6, 2026) — the mobile number change service in the Absher app and its five steps.
• Absher reply on X (January 12, 2025) — in-app change when the number is registered in the user's name, otherwise via self-service machines or registration and activation offices.
• Umm Al-Qura: Implementing Regulation of the Personal Data Protection Law (Arabic) — Article 1 (breach definition), Article 7 (correction requests), Article 22 (correcting data), Article 24 (notification within 72 hours).
• Communications, Space and Technology Commission: Regulations for Number Portability between Fixed and Mobile Services — clauses 4-13 and 4-14 and the 90-day retention period.
• Ajel (October 7, 2026) (Arabic) — coverage of the steps to change a mobile number in the Absher app.