I'm fairly lucky in that my work gives me a new phone about every year. So far I haven't had to pay for it, even though I've been using it for more than a year.

I'm not sure how that works with their "login" stuff, though, since I'd get a new IMEI with each new phone, but it just seems to work and the contact list is still there...

Personally, I'd always assumed there was no security at all and it just worked off your phone number. Certainly, I never treated any of it as in any way secure.