Garmin Messenger is placing too much trust in SMS verification, and this might not end well

Handing over an old phone number shouldn’t mean handing over your private conversations. But a Garmin Messenger user has raised an uncomfortable question: Could the next person assigned your number inherit your chats, too?

In a Reddit post, the user describes installing Garmin Messenger on a second, freshly set-up phone. They entered their existing number, verified an SMS code, and watched their previous conversations reappear. No Garmin account password was required. The second phone reportedly also began sending and receiving messages, with no obvious way to view or remotely disconnect other sessions.

For someone upgrading phones, that sounds wonderfully convenient. The worry begins when the number changes owners.

Carriers routinely reassign abandoned numbers. If Garmin Messenger doesn’t distinguish a new subscriber from the previous owner, a stranger who legitimately receives that number might be able to retrieve old conversations. Importantly, the Reddit test involved the same person controlling both phones. No recycled-number takeover has been demonstrated, and knowing someone’s number alone isn’t enough since an SMS verification code is still required.

This is especially sensitive given what Garmin Messenger does. The system keeps adventurers connected through conversations that can include check-ins, travel plans, and shared locations. If those details fall into the wrong hands, someone could potentially track where you’ve been, discover where you’re headed, or pinpoint your location while you’re out in the wilderness. At that point, this isn’t just about exposed messages. It’s a potential threat to your physical safety.

Garmin’s documentation explains why it didn’t require a password. Unlike a regular Garmin account, Messenger lets users sign in using just their phone number and an SMS verification code. That’s convenient for getting back into your chats, but it also raises questions about what happens if someone else gets hold of that number.

Garmin support allegedly said the behavior works as designed but agreed to review the findings. Sports tech reviewer Ray Maker, better known as DC Rainmaker, also contacted Garmin about the findings and said the company had forwarded them to the appropriate team. But neither response confirms a security flaw or a fix.

Notably, uninstalling Garmin Messenger doesn’t sever its connection to your number. If you’re giving up a number, open Messenger and go to Accounts > Manage Garmin Messenger Account > Delete Garmin Messenger Account. Garmin says this removes the number’s association without canceling an inReach subscription.

But until Garmin clarifies how it separates former and current number owners, it’s worth having this conversation before your old number gets a new life.

We’ve reached out to Garmin for clarification on the reported behavior, particularly whether recycled phone numbers could expose previous conversations and what safeguards are in place. We’ll update this article as soon as we hear back.