Update, 7 September 2026: revised the Japan and Mexico rules and added the travel-data product section and affiliate disclosure. Other country and service records retain their stated check dates. The FCC discussion describes the proposal reviewed on 14 July 2026, not its current legal status.
Affiliate disclosure: The nadanada link marked “affiliate” may earn CypherpunkGuide a commission if a qualifying purchase is credited to us. Commission rates do not determine our assessment. This article explains what the provider documents and what I have not tested. We carry no surveillance advertising, ad-network scripts, tracking pixels, or sponsored articles.
Every signup form asks for it. Your bank, your dentist, your grocery loyalty card, and — as I found while pulling the signup requirements of six major hosted AI services in July 2026 — your chatbot. A user on r/privacy put it better than most security vendors manage: the phone number is the new SSN. It is the one identifier most people never change, carry across every service, and hand out dozens of times a year, which makes it the cheapest join key an adversary or a data broker could ask for.
The complication is that 2026 is squeezing the escape routes from two directions at once. From above, the US FCC’s April 2026 proposal would require that every phone provider collect “the name, physical address, government issued identification number, and an alternate telephone number” of each new and renewing customer — the model that 157 countries already enforced in some form as of Privacy International’s 2021 global tally. From below, services are quietly refusing the workaround every guide recommends first — VoIP numbers, the internet-based phone numbers apps like Google Voice or Hushed hand out, tied to no SIM card. Anthropic’s help center now states you “cannot use VoIP numbers, Google Voice, phone numbers created using apps, landlines” to open a Claude account, and Google Voice itself started requiring government ID from new users in January 2026. Meanwhile the number you already have keeps leaking: the FBI logged 982 SIM-swap complaints and $26 million in losses in 2024, and a surveillance vendor was caught exploiting SS7 — the 1970s-era routing protocol between carriers — to locate phones by number through 2024 and 2025.
So the honest question is not “how do I hide my phone number” — you cannot fully, and pretending otherwise is how people get hurt. The question is which number does which job. This article maps what a number reveals, documents the squeeze with primary sources and a country-by-country table, shows — from my own review of each service’s signup requirements — which services actually reject alternative numbers, and then lays out the four-number strategy that still works, matched to four concrete threat models.
Your Phone Number Is an Identity Document Now#
Phone number identity binding is the practice of using your phone number as a proof of who you are — not just a way to reach you. That is what changed. A contact detail can be swapped; an identity anchor is what accounts, brokers, and governments use to link everything else together. Three mechanics make the number uniquely dangerous in that role.
It unlocks accounts that were never yours to lose. A SIM swap is an attack where someone convinces your carrier to move your number onto their SIM card; every text message — including login codes — then goes to them. This is not exotic. When Princeton researchers tested five major US prepaid carriers in 2020, their SIM-swap attempts succeeded in 39 of 50 tries (78%), and of 140+ popular websites they audited, 17 could be taken over with the phone number alone — no password needed. The FBI’s Internet Crime Complaint Center recorded 982 SIM-swap complaints with $25.98 million lost in 2024; down from $72.7 million in 2022, though some losses may now be logged under adjacent fraud categories.
It broadcasts your location to anyone who can rent the access. SS7, the signaling network carriers use to route calls between each other, lets whoever gains entry ask “where is this number right now.” In 2025, researchers at telecom-security firm Enea documented a surveillance vendor using a malformed-command trick to bypass carrier defenses and pull phone locations on demand — an attack class Enea has tracked in active use since late 2024. You do not need to click anything. Knowing your number is enough.
It resolves to your name. In the US, CNAM — the caller-name database carriers maintain — maps numbers to registered names, and commercial people-search sites cross-reference numbers against breach data, voter rolls, and property records to return a name and home address for a few dollars. A “private” number that has ever been tied to your identity is an index entry, permanently. That permanence is the same dynamic I documented for social media history: deleting the visible copy does not delete the join key.
The Squeeze: ID From Above, Rejection From Below#
Here is the structural shift most guides have not caught up with: the two escape routes people relied on — buy a prepaid SIM with cash, or use an internet number — are being closed from opposite ends at the same time. Understanding both jaws of the squeeze is what makes the strategy in the next sections realistic instead of nostalgic.
From above: registration mandates. Privacy International’s 2021 survey counted 157 countries requiring SIM identity registration, 34 without that requirement, and 14 requiring biometrics such as face scans. Those figures describe that survey, not a current global count.
Mexico requires identity-linked registration for covered mobile lines. The CRT’s current schedule gives unregistered prepaid lines deadlines from August 15 to December 31, 2026, depending on the number’s final digit. Service is temporarily suspended within 72 hours after the applicable deadline and restored after registration. Article 1 of the rules exempts numbers associated with SIMs that lack the technical capability for outgoing voice calls, sending SMS, and internet calls. A plan sold as “data-only” does not, by that label alone, establish that it qualifies for the exception.
For the United States, the proposal reviewed for this article on July 14, 2026 was the FCC’s April 2026 proposal, docket CG 17-59, published in the Federal Register on May 26. It proposed identity checks — know your customer, or KYC — collecting a name, residential address, government-issued ID number and alternate telephone number, with records kept for four years after the customer relationship ends. Its reply-comment deadline was July 27, 2026. This describes the proposal as reviewed in July, not a finding about its current legal status.
Japan promulgated an amendment on May 29, 2026. The ministry’s summary describes an extension of the identity-check framework beyond voice to data services. Most provisions take effect on a date set by Cabinet order within one year of promulgation. This does not establish that every data-only SIM is already subject to the same checks. Check the effective rules and whether the specific service is covered when you buy.
The people this squeezes first are not criminals. The National Network to End Domestic Violence told the FCC that the “suspicious” behaviors the proposal targets — paying cash, using a PO box or a mail-forwarding address — “are, for survivors, well-established and often life-preserving safety practices.” A survivor fleeing an abuser may have no safe address to give and no documents she can retrieve. Journalists and their sources have the same problem with different stakes. This is the pattern I keep returning to on this site: identity checkpoints built for fraud land hardest on the people with the most to lose.
Where your country stands. I built this table from primary legal sources and Privacy International’s survey; each row carries its own source and check date. It is a snapshot of representative regimes, not a complete list.
| Country | ID required for prepaid SIM? | What is checked | Data-only SIM | Source |
|---|---|---|---|---|
| United States | No legal mandate — FCC proposal reviewed July 2026; current status not rechecked | — | — | source · 2026-07-14 |
| United Kingdom | No legal mandate | — | — | source · 2026-07-14 |
| Portugal | No legal mandate | — | — | source · 2026-07-14 |
| Germany | Required by law (2017) | Government ID | Same rule | source · 2026-07-14 |
| Spain | Required by law (2007) | Government ID | Same rule | source · 2026-07-14 |
| Mexico | Required by law (2026) — Identity-linked registration; prepaid deadlines vary by final digit (Aug–Dec 2026) | Government ID | Technical-capability exception; check the plan | source · 2026-09-07 |
| Brazil | Required by law | Government ID | Same rule | source · 2026-07-14 |
| Japan | Required by law — 2026 amendment extends the legal framework to data services; implementation needs checking | Government ID | Check effective date and service scope | source · 2026-09-07 |
| China | Required by law (2019) | Government ID + face scan | Same rule | source · 2026-07-14 |
Snapshot of representative regimes, not a complete list — rules change; every row carries its source and last-checked date. "No legal mandate" does not mean carriers collect nothing: payment records, store cameras, and carrier policies still exist.
Before relying on a prepaid route, check the current local rules and carrier requirements using the sources in your country’s row. A historical “no legal mandate” label does not guarantee an ID-free purchase today. Where identity checks apply, using that number for a separate role does not remove its link to you.
From below: the services themselves. Even where the law is silent, platforms increasingly refuse numbers that are not tied to a carrier account — and they can tell the difference. Twilio’s Line Type Intelligence API, one of several commercial lookups, classifies any number into twelve types — mobile, landline, fixedVoip, nonFixedVoip, and so on — and Twilio openly markets filtering “nonFixedVoip” numbers out of verification flows to fraud teams. Google Voice, once the default privacy recommendation, now requires government ID verification for new numbers (January 30, 2026). The workaround economy is being priced and permissioned out.
I Checked Which AI Services Reject Alternative Numbers#
A dated comparison of documented requirements is more useful than an abstract warning. In July 2026 I pulled the current signup requirements of six major hosted AI services from their own help centers, terms, and privacy policies, archiving each source as part of a larger requirements dataset I am building — treat the table as a dated snapshot and verify against each provider’s current pages before relying on it. AI assistants are a fair test bed: they are the fastest-growing account category, and as I showed in the AI-assistant audit, what you tell them is a record.
| Service | Phone at signup (as of 2026-07) | Number-free path | Detail that matters |
|---|---|---|---|
| Claude (Anthropic) | Required — all new accounts, SMS only | None | VoIP, Google Voice, app numbers, landlines rejected; one account per number |
| ChatGPT (OpenAI) | Not required via email/SSO | Email or Google/Microsoft/Apple SSO | Phone-only signup exists but is limited to 13 listed regions |
| Gemini (Google) | Follows Google Account rules | Google Account | Binding is to your entire Google identity, not just a number |
| DeepSeek | Email or phone | Email path | Either identifier accepted at registration |
| OpenRouter | Not required | Email/SSO | A router: your identity exposure shifts to whichever provider serves the model |
| Venice | Not required | Email, social, or crypto wallet | Demo works with no account at all — the lowest-binding path we found |
The Claude row deserves the verbatim quote, because it is the clearest statement of the new normal from any major service: “We require phone verification for all new users, and there isn’t a way to skip this step… you cannot use VoIP numbers, Google Voice, phone numbers created using apps, landlines, or other numbers that can’t receive texts to verify your account.” One real mobile number, one account. The spread in that table is the practical point: the same product category ranges from “carrier-verified phone, no exceptions” to “no account needed.” Which number — if any — a service deserves is a choice you still get to make, but only if you check before you type your real one.
The Four-Number Strategy That Still Works#
A single phone number doing every job is the vulnerability. The durable fix is role separation — the same compartmentation logic that runs through threat modeling in the AI age — applied to the one identifier people forget to compartment. Phone numbers are cheap; being findable by one join key is expensive. Four layers, from most protected to most disposable:
| Layer | The number | Give it to | Never use it for |
|---|---|---|---|
| 1 — Vault | Your real carrier number | Carrier, banks that force SMS, government | Any website signup, messaging apps, directories |
| 2 — Identity | Secure messenger behind a username | People you actually talk to | Public posting; discovery left open |
| 3 — Account | One or two VoIP numbers | Shops, newsletters, apps that accept VoIP | Anything that can drain money |
| 4 — Edge | Prepaid SIM (where lawful) or no number | One-off verifications, classifieds, travel | Logging into Layer-1/2 accounts |
Setting it up in order:
- Harden the vault before anything else. Call your carrier and set a port-out PIN or number lock — the Princeton results show why carrier authentication is the weakest wall. Then remove the real number from every account that lets you swap in an authenticator app or passkey; SMS should be your second factor only where nothing else is offered.
- Share a Signal username to start contact. Signal’s phone-number privacy settings and usernames have been available since February 2024. Registration still requires a phone number. Under Settings → Privacy → Phone Number, set “Who can see my number” to Nobody; set “Who can find me by my number” to Nobody to prevent discovery through that number. Share your exact username, QR code or link instead. The username starts contact; chats display your profile name, not the username. These settings do not erase a number someone already knows or prevent existing conversations from identifying you.
- Buy the account layer. A VoIP service — internet telephony, numbers not tied to a SIM — like MySudo or Hushed gives you compartment numbers for a few dollars a month; JMP.chat runs over XMPP and is popular in privacy communities. Expect exactly what the table above showed: some services will reject these numbers, and that rejection is itself information about how much identity that service demands.
- Keep an edge layer where the current rules allow it. A cash-bought prepaid SIM can serve one-off verifications where local rules and the carrier permit a purchase without identity checks. Check before buying; the US entry here was last reviewed on July 14, 2026. Where identity checks apply, consider services that offer an email path, a wallet path, or no account at all. I do not recommend lying to a carrier or evading a legal ID requirement.
Two payments notes, briefly: pay for VoIP layers with a masked or prepaid card where you can, because a privacy number billed to your real card is a paperwork detour, not a wall; and if you already keep KYC-free bitcoin for principle’s sake, JMP.chat is one of the few number services that accepts it.
Travel data is a separate job from account recovery#
A travel data plan can supply internet access without supplying a number for SMS verification. Keep that purchase separate from the number you rely on to recover important accounts. Start with the job you need the plan to do, then compare it with what your existing mobile plan already covers.
With an eSIM, a compatible phone can install a mobile service profile without inserting another physical SIM card.
As checked on 6 September 2026, the Local, Regional and Global plans listed as data-only on nadanada’s eSIM page are internet-access options. They do not supply an SMS number. The same page lists Nadaworld separately with SMS and voice, while the general terms describe eSIMs as data-only. Check the conditions for the exact product family; I have not assessed Nadaworld’s acceptance for verification codes or its suitability as a long-term recovery number.
Before choosing a travel-data plan, check these five points:
| Check | What to establish before paying |
|---|---|
| Phone | Confirm eSIM support for your exact model and regional version, and any carrier lock that could prevent installation or use. |
| Destination | Check coverage for every country on your trip and any plan-specific network restrictions. A country listing does not establish signal quality at your location. |
| Allowance and timing | Compare the total price, data allowance, activation deadline, and when validity starts. Check whether hotspot use (sharing the phone’s internet connection with another device) and top-ups meet your needs. |
| Failure and refund | Read the selected plan’s installation instructions, support route and refund conditions. Do not assume an unused or failed activation is automatically refundable. |
| Information retained | Check what the seller and payment provider collect and retain. An account-free checkout is not evidence that the service keeps no records. |
The privacy policy says nadanada retains the eSIM identifier (ICCID), purchased-bundle status, and activation and expiration information. It gives no fixed retention period for these eSIM records. Its seven-day deletion period for website logs does not apply to them.
I have not tested this service’s activation, coverage, speed, support or deletion practices. The product details above are provider statements, not an independent audit. A separate eSIM alone does not establish that a carrier cannot connect the phone or its activity to you. This is a travel-data option to evaluate, not evidence of anonymous mobile use or a replacement for a durable recovery number.
Use the travel-data purchase checklist to record the plan and its conditions before spending. If it fits your trip and phone, view nadanada’s plans (affiliate) and select the eSIM category. A qualifying purchase credited through that link may earn this site a commission.
Match the Numbers to Your Threat Model#
Strategy only means something against a named adversary. Four that cover most readers — pick yours and the table above collapses to two or three concrete moves.
| Threat | What they exploit | Your moves |
|---|---|---|
| Data brokers / marketers | Number as join key across services | Layer 3 everywhere; never the vault number on forms |
| Breach + credential attackers | SMS codes, reused identifiers | Authenticator/passkeys on vault accounts; carrier PIN |
| A person — stalker, ex, harasser | People-search, CNAM, shared history | New Layer 2 with hidden number; broker opt-outs; Layer 1 known to almost no one |
| Well-resourced / state-level | SS7 location, carrier records, registration data | No number you carry is location-safe; separate devices — see the activist safe-publishing protocol |
The stalker row is the one I write for. The FCC filing record says the quiet part: the survivors’ network describes cash-paid phones and confidential addresses as “life-preserving safety practices,” and those are precisely the behaviors a KYC regime flags as suspicious. If your threat is a person who knows your name, the vault number they already have is the risk — a number they have never seen, on a messenger that will not confirm it, is worth more than any amount of blocking.
What Does Not Work#
Debunking is a defense layer of its own; these four failures cost real money and real safety.
- “A burner app makes me anonymous.” A VoIP number hides your carrier number from the person you call — it does not hide you from the app, which knows your payment method, IP address, and often your contact list, and it fails carrier lookups the moment a service checks line type. Useful compartment, not an invisibility cloak.
- “I’ll just change my number.” The old number stays in every broker database, breach dump, and CNAM record you ever touched, and the new one starts accumulating the moment you hand it out the same way. Rotation without role separation resets nothing.
- “Prepaid is anonymous.” Privacy International’s 2021 survey counted 157 countries with SIM registration requirements. Even where there is no legal mandate, payment records, store footage and carrier policies can link a purchase to you. Paying cash does not establish anonymity in use; it does not remove the location-tracking risks described above.
- “SMS two-factor is better than nothing.” True, and it is also the mechanism that made 17 of 140+ audited sites takeover-able by number alone. Where an authenticator app or passkey exists, SMS is not your backup — it is your attack surface.
Bottom Line — Which Setup Is Right for You?#
If you do one thing today: set a carrier port-out PIN and remove your real number from every account that accepts an authenticator app instead. These measures reduce your exposure to SIM swaps, which produced $26 million in reported US losses in 2024. They do not guarantee protection against every carrier or account-recovery failure.
For the full setup, assign separate roles: a vault number for banks and government, a Signal username for contacts, a VoIP number for accounts that accept it, and a prepaid number where current rules permit it. Check each service’s requirements first. A wallet-based signup can avoid handing over a phone number, but it does not establish that the account cannot be linked to you. Consider the wallet’s history and the service’s other data collection too.
Keep the dates in view: the FCC proposal’s reply-comment deadline was July 27, 2026; Japan’s implementation date and the scope of its data-service rules need checking. Each row of the table carries its own check date. Number privacy is a structure you maintain as rules and services change.
Frequently Asked Questions#
Is a VoIP number enough to keep my identity private?#
It compartments — it does not anonymize. A VoIP number stops shops and apps from learning your carrier number, but the VoIP provider knows your payment method and IP address, and services can detect the line type via lookup APIs like Twilio’s and refuse it, as Claude does. Use VoIP for the account layer, never as your only wall.
Are burner phones illegal in 2026?#
A prepaid phone is not inherently illegal. Whether buying or using one requires identity checks depends on the jurisdiction and the service. Privacy International counted 157 countries with registration mandates in 2021; that is not a current total. The US entry in this article was checked on July 14, 2026, and the FCC discussion describes the proposal reviewed then. Check the current rule linked from your country’s row before relying on it. Buying under a false identity can itself be an offense.
Does Signal still require my phone number?#
Yes. Registration still requires a phone number. “Who can see my number” controls number visibility; “Who can find me by my number” controls whether someone can discover you using it. Set both to Nobody if you want people to initiate contact through your username, QR code or link instead. Chats show your profile name, not your username. These settings cannot make someone forget a number or identity they already know.
What happens if the FCC proposal becomes law?#
Under the proposal reviewed in July 2026, US providers, including prepaid providers, would collect a customer’s name, residential address, government-issued ID number and an alternate phone number, retaining those records for four years after the customer relationship ends. Domestic-violence advocates told the FCC that this would turn survivors’ safety practices into warning signs. If such a mandate takes effect, the US prepaid route would also require identity checks. The edge layer would need to rely more on services that do not require a phone number, subject to the rules where you live.
Should I just get a new number and start over?#
Only as part of role separation, and only if your threat is a specific person who has the old one. The old number remains in broker databases and breach dumps permanently, and a new number used the old way — one number for everything — rebuilds the same profile within months. Structure beats rotation.
Sources#
Cora Aegis writes about Bitcoin privacy, self-custody, and digital sovereignty under a pseudonym — an arrangement this article should make self-explanatory. Sources for every statistic are listed above; the country table carries its own per-row sources and check dates. Corrections: cora@cypherpunkguide.com.
