Phone numbers & telecom

Three identifiers are involved. The phone number is what people and services see. The IMSI (International Mobile Subscriber Identity) is stored on the SIM or eSIM and identifies your subscription to the network. The IMEI identifies the handset itself. Whenever the phone is on, the network knows which cell towers it is near, because that is how calls and data reach you. Operators keep these records, and police can usually obtain them, including “tower dumps” that list every phone near a place at a given time.

Tracking through the phone network: SS7 and Diameter

Mobile operators exchange signalling messages with each other to route calls and texts and to let phones roam: SS7 on 2G and 3G networks, and Diameter on 4G. Both were designed for a small circle of trusted operators, and intelligence agencies and surveillance companies have long abused them. Someone with access can ask your operator where your phone is, or intercept calls and texts, without touching the phone. A Defense Department letter released in 2024 revealed that Department of Homeland Security officials had named China, Russia, Iran and Israel as the main countries exploiting these networks to spy on people in the US (404 Media).

A 2025 investigation coordinated by Lighthouse Reports found more than a million tracking operations, mostly from 2007 to 2014, in the records of a single commercial SS7 tracking product, Altamides, with targets in 100 countries (Mother Jones). In July 2026 the Financial Times reported that Iran used the same weaknesses to locate US military personnel in the Middle East (TechCrunch). Apps on your phone cannot see or block these requests. What you can do is keep sensitive conversations off ordinary calls and SMS: use end-to-end encrypted apps (see the messaging guide), so that anything intercepted is unreadable.

IMSI catchers (fake cell towers)

An IMSI catcher, also called a cell-site simulator or Stingray, pretends to be a mobile tower. Phones nearby connect to it and reveal their IMSI, which tells its operator who is present. Many models push phones down to 2G, which lacks mutual authentication and whose encryption can be weakened or switched off, so calls and texts can be intercepted. Android 12 and later can disable 2G at the modem level on supported phones (Google), and iPhone Lockdown Mode turns off 2G and 3G (Apple). The EFF’s open-source Rayhunter can warn you about some of these attacks.

SIM swapping

In a SIM swap, a criminal talks or bribes your operator into moving your number to a SIM they control. Your phone loses service and they receive your calls and texts, including login codes. In the UK, unauthorised SIM swaps reported to the National Fraud Database rose by 1,055% in 2024, to nearly 3,000 cases (Cifas). Ask your operator for a port-out PIN or number lock, and move important accounts from SMS codes to an authenticator app or passkey; see the password guide.

SIM registration keeps spreading

By January 2020, 155 countries required people to register prepaid SIM cards with ID (GSMA), and the requirement keeps spreading. Mexico has been suspending mobile lines whose owners have not linked them to an official ID and their CURP (population register number), on a schedule that runs to the end of 2026 (CRT, October 2026). In the US, the FCC asked in May 2026 for comment on requiring phone providers, mobile and VoIP included, to collect the name, physical address, government ID number and an alternate phone number of every new and renewing customer before giving service (FCC 26-27); this is a proposal, not yet a rule. Internet number providers are moving the same way: Google Voice now asks new users for a government ID, MySudo requires legal identity details for UK numbers, and OnlineSIM’s terms let it demand identification at any time.

As a rule, the closer a number is to a real SIM card, the more services accept it, and the more you have to trust whoever holds that SIM.

These are complete mobile services, with a real SIM or eSIM for calls, texts and data, from companies that do not ask for your name. Both currently serve the US only. They run on the large carriers’ networks, which still see the SIM, the handset and where it is. The FCC’s May 2026 proposal to make phone providers collect customer ID (see above) would cover carriers like these if it is adopted.

A VoIP number lives on a server and reaches you through an app or a chat account over Wi-Fi or mobile data. It keeps your SIM number private and you can have several. The trade-offs: many banks and online services recognise VoIP numbers and refuse them for sign-up or login codes, and the provider can see every call and text, because ordinary calls and SMS are not end-to-end encrypted.

These services sell mobile data or numbers on real SIM cards, paid in cryptocurrency and without ID. An eSIM goes into your own phone and mostly provides data, sometimes with a number. A rented SIM number stays in the provider’s hardware and the texts are forwarded to you, which helps with services that refuse VoIP numbers. The network still sees your handset: an anonymous eSIM in the same phone as your normal SIM is easy to link to you, so consider a separate device. You also have to trust the operator, and two of the three below do not say who they are.

Activation services rent you a mobile number for a few minutes so you can receive one code. They are cheap and quick, and often accepted where VoIP numbers are not. The catch is that the number goes back into circulation. Whoever gets it next can request a password reset by SMS, so never use one for an account you want to keep, and switch such accounts to an authenticator app at once. Free “receive SMS online” websites are worse: their numbers and messages are public, so anyone can read your code.

Phones do not tell you when they connect to a fake tower. A separate detector can watch for the tell-tale signs, which is useful for journalists, organisers and anyone attending protests.

• Give out your real number as little as possible. Use a separate number for shops, sign-ups and people you do not know well, and keep your real one for your bank and close contacts.
• Prefer services that need no number at all. Several messengers work without one; see the messaging guide.
• Keep identities apart. Use a different number for each identity, and do not let them share a device, a payment method or a contact list; see the alting guide.
• For accounts you need to keep, use a number you control long-term, not a temporary one, and replace SMS codes with an authenticator app or passkey as soon as the account allows it.
• Numbers on real SIM cards are refused less often than VoIP numbers for sign-up codes. If a service rejects your VoIP number, a rented SIM number is the next step; keep paying for it for as long as the account matters.
• A data-only eSIM plus a VoIP number gives you calls and texts without a number attached to the SIM itself.
• Pay privately. Monero or cash leave the fewest traces; Bitcoin bought on an exchange that checked your ID can be traced back to you. Where crypto is not accepted, see the virtual cards guide.
• Lock your main number: set a port-out PIN or number lock with your operator, and act at once if your phone suddenly loses service.
• Turn off 2G in Android’s network settings if your phone offers it, or use Lockdown Mode on an iPhone if you face targeted threats.
• Leave the phone behind, or in another room, for sensitive meetings. Many phones switching off at the same time and place can itself stand out.
• Check the law where you are. SIM registration, rules for rented numbers and the legal status of SIM-hosting services differ between countries.

• Assuming a second number makes you anonymous. The network still sees your handset and its location, and the people you call link the new number to you.
• Putting an anonymous SIM in your everyday phone. The handset and its movements tie both lines together.
• Using a temporary number for an account you care about. Once the number is reissued, the next holder can receive your reset codes.
• Using free public SMS websites for anything private: anyone can read the messages.
• Relying on SMS for login codes on email, bank or crypto accounts, which exposes them to SIM swaps and signalling attacks.
• Paying with a card in your own name for a line you wanted to keep separate from your name.
• Letting apps upload your address book. Contact discovery lets other users find you by your number.

• EFF Surveillance Self-Defense: The problem with mobile phonesssd.eff.orgLocation tracking, IMSI catchers and the limits of burner phones; last reviewed in 2018.
• EFF: Gotta Catch ’Em All, how IMSI catchers exploit cell networks (2019)eff.orgTechnical explanation of fake base station attacks, mainly on 2G and 4G networks.
• Mother Jones and Lighthouse Reports: the Altamides SS7 tracking investigation (2025)motherjones.com
• TechCrunch: Iran abused mobile network weaknesses to locate US military (2026)techcrunch.com
• CISA: Mobile communications best practice guidancecisa.govFor highly targeted people, written in response to state-backed intrusions into telecom networks; revised March 2026.
• Europol: SIM-box service takedown, Operation SIMCARTEL (2025)europol.europa.eu