{"id":490,"date":"2025-02-15T21:11:13","date_gmt":"2025-02-16T03:11:13","guid":{"rendered":"https:\/\/blog.unspecific.com\/?p=490"},"modified":"2025-02-17T14:08:35","modified_gmt":"2025-02-17T20:08:35","slug":"burner-phones-what-they-are-and-what-theyre-not","status":"publish","type":"post","link":"https:\/\/blog.unspecific.com\/?p=490","title":{"rendered":"Burner Phones: What They Are (and What They\u2019re Not)"},"content":{"rendered":"\n

Every year, as Hacker Summer Camp<\/em> rolls around, there\u2019s a surge in discussions about burner phones. And every year, I shake my head at some of the misconceptions floating around.<\/p>\n\n\n\n

\n
\n

A true burner phone is a means of communication that isn\u2019t easily tied to you. The goal is to remain anonymous\u2014or at least harder to identify. But in today\u2019s world of modern smartphones and interconnected services, staying off the radar takes more effort than just buying a cheap phone.<\/p>\n\n\n\n

These are concepts from research, stories, fictional situations and in no way should be taken as advice or even accurate.  I am not a lawyer and not everything mentioned here is legal everywhere, as far as I know. This article is meant to make you think about all the ways you can be associated with a new device **<\/sup><\/sub><\/pre>\n<\/div>\n<\/div>
\"driven<\/figure><\/div>\n\n\n\n
Acquiring a Burner Phone the Right Way<\/strong><\/h3>\n\n\n\n
If you order a phone online with your credit card and have it shipped to your home, it\u2019s not a burner. Every phone has unique identifiers, and both the seller and service provider track them.<\/p>\n\n\n\n
Here\u2019s how to do it properly:<\/p>\n\n\n\n
\u2705 Buy the phone in person.<\/strong>
\u2705 Use cash.<\/strong>
\u2705 Purchase it in your destination city, if possible.<\/strong> At the very least, don\u2019t buy it where you live.
\u2705 Use a different carrier than your usual provider.<\/strong>
\u2705 Make sure the carrier accepts cash and offers prepaid options without registration.<\/strong><\/p>\n\n\n\n
The key is ensuring that neither the phone number nor the IMEI can be easily traced back to you.<\/p>\n\n\n\n
Setting Up Your Burner Phone<\/strong><\/h3>\n\n\n\n
Now that you have an unregistered phone with an ‘anonymous1<\/a><\/sup>‘ connection, what\u2019s next?<\/p>\n\n\n\n
\ud83d\udeab<\/strong> Do NOT install your usual apps.<\/strong><\/summary>\n
If your plan is to use Facebook, Twitter, or Bluesky, you don\u2019t need a burner\u2014just lock down your existing phone. If you just want a disposable device, that\u2019s fine, but that\u2019s not really a burner.<\/p>\n\n\n\n
Keep in mind that social media apps track you and even analyze conversations to target ads. It\u2019s best to avoid installing any apps you don\u2019t absolutely need. If you have to use them, stick to the web version whenever possible.<\/p>\n<\/details>\n\n\n\n
\ud83d\udeab Do NOT log into your normal accounts.<\/strong> <\/summary>\n
The moment you sign into your regular apps, that phone is tied to you. Game over.<\/p>\n\n\n\n
If you absolutely need to use social media, create a brand-new account after<\/em> you arrive at your destination. Don\u2019t follow or connect with anyone\u2014use it only for public drops, like scrubbed\/anonymized photos, event updates, or encoded messages.<\/p>\n\n\n\n
When the event is over, abandon the account. Never log into it again, especially outside the venue. Even accessing it at the airport can reveal which airline you flew and narrow down your travel details.<\/p>\n<\/details>\n\n\n\n
\ud83d\udeab Do NOT text all your friends from the new number.<\/strong> <\/summary>\n
Even if your name isn\u2019t tied to the account, your contacts, conversations, and habits can still give you away. A true burner setup means using a burner phone only<\/em> with burner accounts\u2014ideally, with others following the same protocol.<\/p>\n\n\n\n
Plan ahead. Arrange a meetup at the event based on your risk model. If it\u2019s just your usual group of friends grabbing beers, it\u2019s simple.<\/p>\n\n\n\n
When you meet, exchange your new Signal (or similar) handles. Don\u2019t include the event name<\/strong> in the handle\u2014keep it random, ideally a short two- or three-word phrase. Many password generators have a word-based option\u2014use that for your username too.<\/p>\n\n\n\n
Store all authentication directly on the phone, using the built-in password manager. Avoid biometrics.<\/strong> Instead, use a long PIN or complex pattern to lock the device.<\/p>\n\n\n\n
When using the phone, do so in common areas<\/strong>, not your hotel room. This is actually a good time to use the conference WiFi.   <\/p>\n\n\n\n
Once you\u2019ve established encrypted communication with your new accounts, then (and only then) share any additional contact info\u2014like social media accounts for public updates or drop locations.<\/p>\n\n\n\n
For retrieving photos, obfuscated messages, or taunts, do it once<\/em> and never return. Let others poke around if they want, but don\u2019t go straight to the source yourself.<\/p>\n<\/details>\n\n\n\n
\ud83d\udeab Do NOT broadcast your burner phone info.<\/strong> <\/summary>\n
Announcing, \u201cThis is my burner phone, contact me here!\u201d<\/em> completely defeats the purpose. Instead, wait until you see people in person to share the number. We\u2019ve already covered that.<\/p>\n\n\n\n
Use only<\/strong> the burner phone for the SMS verification needed to create burner accounts\u2014everything else should be built off that number. And before you leave town, destroy the phone<\/strong>.<\/p>\n\n\n\n
The accounts should remain accessible for a while after you destroy the phone since verification was tied to that device. That gives you enough time to grab any necessary data, as we discussed.<\/p>\n<\/details>\n\n\n\n
\u2705 Create new accounts from the burner phone.<\/strong> <\/summary>\n
Use completely different<\/strong> usernames and handles. If you reuse known accounts, staying anonymous is impossible.<\/p>\n\n\n\n
Create new<\/strong> accounts for the event from the burner phone<\/em>. Use the burner phone number as the foundation for everything. Do not<\/strong> link these accounts to any existing emails or phone numbers\u2014keep them completely separate.<\/p>\n<\/details>\n\n\n\n
\u2705 Reach out to new contacts from the burner phone.<\/strong><\/summary>\n
Once the phone is set up, only<\/strong> contact the new accounts your contacts created for this event. Any associations made from this phone and number should be strictly limited to event-specific accounts.<\/p>\n\n\n\n
If you only interact with your usual contacts, it becomes easier to trace the phone back to you. To help obscure your real activity, mix in unrelated interactions\u2014browse random social media feeds, engage with different content, and add noise to bury the signal.<\/p>\n<\/details>\n\n\n\n
\u2705 Destroy the phone after the event.<\/strong> <\/summary>\n
Never log into those accounts again and never aNever log into those accounts again, and never<\/strong> access them from home or any familiar network. If you absolutely must check them later, use TOR or another method<\/strong> to cover your tracks. Ideally, you should only log into these accounts during the event.<\/p>\n\n\n\n
All accounts should remain tied only<\/strong> to the burner phone number and the initial email used for setup. Do not<\/strong> use that email for anything else. Treat the social media accounts as dropboxes or for intentional public messages\u2014nothing more.<\/p>\n\n\n\n
At the end of the event, destroy the phone<\/strong>. Turning it on later, away from the event, risks exposing its unique identifier when it connects to a cell tower. That could link the account to a new location\u2014potentially revealing where you live or even which terminal you flew out of.<\/p>\n<\/details>\n\n\n\n
\u2705 Use end-to-end encryption (E2EE) for communication.<\/strong> <\/summary>\n
For all your communications with contacts, use a good end-to-end encryptFor all communications with contacts, only<\/strong> use end-to-end encrypted (E2EE) messaging<\/strong>. As discussed, E2EE ensures that only the intended recipient can decrypt your messages using their private key.<\/p>\n\n\n\n
Signal<\/a><\/strong> is a solid choice, and Session<\/a><\/strong> looks promising as well. With the latest updates in iPhone 18<\/strong>, you can enable E2EE in the Messenger app\u2014but remember, you should only use new<\/strong> accounts. Keep Apple Messenger<\/strong> locked down for personal use at home. For everything else, use Signal<\/strong> whenever possible.<\/p>\n\n\n\n
Never<\/strong> use the same accounts on your burner phone as you do on your regular phone.<\/p>\n<\/details>\n\n\n\n
Additional Security Considerations<\/strong><\/h3>\n\n\n\n
If your safety is at risk\u2014whether due to a domestic situation or an oppressive government\u2014your approach needs to be even more meticulous.<\/p>\n\n\n\n
\ud83d\udd39 Think about the tools you\u2019re using.<\/strong> If you\u2019re on an iPhone, create a new Apple ID, enable Lockdown Mode, disable location services, and remove unnecessary apps. On Android, do the same: new Google account, minimal apps, and as many tracking features disabled as possible.<\/p>\n\n\n\n
\ud83d\udd39 SMS is not secure.<\/strong> Assume all texts are monitored. If you must use SMS, keep messages vague and avoid names or recognizable phrases.<\/p>\n\n\n\n
\ud83d\udd39 Avoid logging into personal sites or services.<\/strong> If you only contact the same people on the same platforms, it\u2019s not hard to link your burner phone to your real identity.<\/p>\n\n\n\n
\ud83d\udd39 Be cautious with links.<\/strong> Many contain trackers, which can instantly associate your burner with your main accounts.<\/p>\n\n\n\n
Final Thoughts<\/strong><\/h3>\n\n\n\n
\n
\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\n



Your approach depends on your threat model<\/strong> and risk tolerance<\/strong>. Old-school burner phones were simple\u2014no smart features, fewer risks. Modern burners require much more effort to keep your identity separate.<\/pre>\n<\/div>\n<\/div>\n\n\n\n
If you just need a phone you can discard after an event to avoid malware or tracking, you\u2019re better off securing your existing phone:<\/p>\n\n\n\n
\ud83d\udd38 Keep your device updated.<\/strong>
\ud83d\udd38 Watch for security warnings, like untrusted certificates.<\/strong>
\ud83d\udd38 Avoid clicking “OK” on anything suspicious, especially on public WiFi.<\/strong><\/p>\n\n\n\n
A burner phone isn\u2019t a magic cloak of invisibility. It\u2019s a tool\u2014and like any tool, how well it works depends on how well you use it.<\/p>\n\n\n
  1. Not really \u21a9\ufe0e<\/a><\/li><\/ol>","protected":false},"excerpt":{"rendered":"
    Every year, as Hacker Summer Camp rolls around, there\u2019s a surge in discussions about burner phones. And every year, I shake my head at some of the misconceptions floating around. Acquiring a Burner Phone the Right Way If you order a phone online with your credit card and have it shipped to your home, it\u2019s […]<\/p>\n","protected":false},"author":1,"featured_media":364,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pgc_sgb_lightbox_settings":"","footnotes":"[{\"content\":\"Not really\",\"id\":\"0703edc2-7a04-43db-9ad8-86be1f1b8cb4\"}]"},"categories":[6,25],"tags":[13,26],"class_list":["post-490","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infosec","category-obvious","tag-infosec","tag-obvious"],"_links":{"self":[{"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=\/wp\/v2\/posts\/490","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=490"}],"version-history":[{"count":24,"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=\/wp\/v2\/posts\/490\/revisions"}],"predecessor-version":[{"id":517,"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=\/wp\/v2\/posts\/490\/revisions\/517"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=\/wp\/v2\/media\/364"}],"wp:attachment":[{"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.unspecific.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}