The authorized SIM and device reseller in Kondele did not welcome broad questions.
Hassan, the manager, read Aisha's authorization twice.
“What exactly do you want?”
“A batch window. Recycled-number events as hashed references. No names, ID numbers or customer contacts.”
“And you want to compare them with your loan engine.”
“Only through identifiers we can map without exposing the new subscribers.”
After privacy counsel approved the scope, Hassan showed them how the fictional network's recycling process worked. A dormant number could return to the pool. When a new subscriber activated it, partners received an activation event.
“The feed says the number is active,” Hassan said. “It does not say the same person came back.”
“That interpretation belongs to us.”
They built a redacted extract and compared activation windows with SawaLink borrower-profile creation.
Most recycled numbers behaved correctly. A new subscriber triggered new onboarding.
One legacy group did not.
When historical closure records used the old code `DCS1`, SawaLink's ingestion service sometimes reused the old customer key. When the newer `DECLOSED` code was present, it did not.
Wekesa tested both paths in local configuration.
“With DCS1, it links the historical identity,” he said. “With DECLOSED, it asks for new onboarding.”
Hassan folded his arms. “The partner feed cannot know your internal closure codes.”
Aisha agreed. The boundary might be where the bug appeared, but responsibility for interpreting the feed belonged to SawaLink.
They added a clean recycled-number case to the evidence. It mattered because it showed recycling itself was not the harm.
Then they looked at sequence.
The relevant activation batch reached SawaLink on Monday evening.
Mama Atieno's and Ouma Auma's new borrower profiles appeared the following night.
Wekesa counted legacy records but Aisha stopped him from calling the entire count “exposure.”
“Potential identity collision is not confirmed harm.”
They created four categories: legacy risk population, profile recreated, reserve journal present, customer impact confirmed.
Hassan insisted on a deletion date for the hashed extract.
Privacy counsel set a thirty-day retention window for identifiers that did not become confirmed cases. Aisha accepted. An investigation that collected data without limits could create a different kind of abuse.
They also recorded an example proving the opposite path: a recycled number with a properly migrated closure code produced a fresh identity and no inherited debt.
Victor's office initially rejected a request to review loan-engine triggers, calling reseller data outside the acquisition issue. Aisha resubmitted the request with the limited, privacy-safe scope and two confirmed collisions.
IT security approved it.
Before she left, Aisha asked Hassan to write one sentence for the technical record.
He typed:
**A number can return; a person does not return with it.**
The sentence was simple enough for a non-engineer and exact enough for a system designer.
The reseller had not opened the loans. The activation feed had not claimed a dead customer was alive.
SawaLink had used the number as a shortcut for identity.
Hassan also showed Aisha the partner-interface documentation proving that SawaLink had never requested a field saying the subscriber was the same human being as the previous owner. The assumption existed entirely downstream. She included that fact in the design defect record because it prevented the company from blaming the reseller for data it had never promised to provide. Wekesa opened a remediation ticket against the ingestion rule with a specific acceptance condition: an active phone event may update contact availability, but it may not reactivate a terminal customer identity without an explicit identity event.
Before they left, Aisha asked Wekesa to run a second comparison using a number that had been recycled twice in its lifetime but had no debt or deceased closure. The new architecture still needed to avoid treating historical contact as identity, even when no immediate money was at risk. The test produced a fresh onboarding path. Hassan noted that this was the ordinary case they wanted to preserve: people should be able to receive old numbers without inheriting suspicion. Aisha added it to the acceptance criteria. The fix was not to make recycled numbers unusable; it was to stop the system from confusing contact history with personhood.
And the activation batch reached SawaLink one day before the loans attached to those old identities were created.