18. MSISDN reuse flow. What happens if user 1 cancels his phone/telco plan and user 2 buys a new sim with the same MSISDN? This is a common situation in Brazil as MSISDN is reused after 3 months.

This is absolutely the same case as a SIM Swap. MSISDN reuse is a legal SIM Swap. Same MSISDN on new(different) SIM card. User 2 will be able to use this phone number because he can prove the possession of it.

It is very important to understand that a Phone Number is not good enough as a primary user ID (or the only one) because it can be reused. It is good as an alternative user ID, and MobileID is perfect for authentication purposes. As primary user ID, we always advise using the email addresses.

In case when MobileID is changed, the Service can use email to re-assign the new MobileID.

Phone Number as a primary user ID is good only in case when there is no server-side profile/data, like Chat Apps (Whatsapp, Viber….). In that case, there is no danger of register a new account with the same ID. But I am not sure it will stay like this when they introduce Payments inside Chat Apps as Whatsapp Pay did, and if they want to keep data on server-side account/profile.