# Your phone number is an identity anchor > Why one phone number can tie an "anonymous" account to a real person: recovery numbers, recycled numbers, SIM swaps and people-search sites. What to use instead, by threat model. Markdown twin of https://xmr.club/guides/phone-number-identity. CC-BY-4.0. Attribute "xmr.club". ## At a glance - Canonical: https://xmr.club/guides/phone-number-identity - Slug: phone-number-identity - Title: Your phone number is an identity anchor - Description: Why one phone number can tie an "anonymous" account to a real person: recovery numbers, recycled numbers, SIM swaps and people-search sites. What to use instead, by threat model. - Published: 2026-11-08 ## Intro A phone number feels like a small detail you hand over to get a code. In practice it is one of the strongest links between an account and a person: carriers know who bought the SIM, shops keep receipts and camera footage, and the same number turns up in breaches and on people-search sites. In November 2026 an FBI affidavit described tying an email account to a man through a phone number and a cellphone he bought at a store. You don't have to be a suspect for the same chain to matter: it is also how stalkers, doxxers and account thieves get from an account to you. This guide is for people with an ordinary reason to keep accounts and identity apart: journalists, activists, people leaving an abusive situation, or anyone who doesn't want a breach to lead to their door. ## Body ## How a number links an account to you - **Recovery numbers.** The number you add "just for account recovery" is stored with the account and handed over when the provider is asked. It turns an account with no name on it into an account with a SIM behind it. - **The SIM's own trail.** A SIM card has a serial number (ICCID). The carrier knows where and when it was activated; the shop knows which sale it was, and often has a receipt and camera footage of that moment. Paying cash removes the card from the trail, not the shop. - **Everything else on the phone.** The handset's own identifier (IMEI), the cell towers it connects to and the apps you sign into on it all point at the same device. A "burner" that ever spent a night at home, or ran your usual apps, isn't separate any more. - **Breaches and people-search sites.** Your main number is almost certainly already in leaked databases next to your name and address. Anyone who finds the number on an account can look the rest up. ## Two other ways numbers bite - **SIM swap.** Someone talks your carrier into moving your number to their SIM, then resets every account that recovers by SMS. This is the most common way crypto accounts get emptied. - **Recycled numbers.** Numbers that lapse, and numbers you rent for a few minutes to receive a code, go back into a pool. The next holder receives your codes. Fine for a one-off signup; never for an account you want to keep. ## What to do instead - **Remove phone recovery where you can.** Use a passkey, an authenticator app (TOTP) or printed recovery codes, kept offline. If a service insists on a number, use one that isn't your main line. - **One number per context.** Keep your main number for family, bank and carrier. Give accounts that shouldn't lead to you a different number, and never cross them: don't add your main number "as a backup" later. - **Match the number to how long you need it.** A one-off code: a rented SMS number is fine. An account you'll keep: a durable number you control, such as a privacy eSIM or a VoIP number paid in crypto, so you can still receive codes in a year. - **Keep the device separate too.** A second number on your everyday phone still shares the handset. For a context that really must stay apart, that means a separate device that doesn't log into your usual accounts. - **Protect the main number.** Ask your carrier for a port-out PIN or SIM-lock, and remove the number from people-search sites (see the yearly privacy audit). ## Pick by threat model - **Spam and breach exposure:** a separate number for signups is enough. - **Doxxing or a stalker:** separate numbers per context, no main number on any public-facing account, and a sweep of people-search sites. - **High-risk work (sources, activism):** a separate device and number for that work, and assume that anything you buy in person can be tied to you by the shop's own records. Where you live matters: some countries require ID for every SIM, and a number registered to someone else can create its own problems. Use what's lawful where you are. More on the options in [No-KYC SMS verification](/guides/no-kyc-sms-verification), on picking a model in [Privacy threat models](/guides/privacy-threat-models), and on cleaning up in [Recover from a privacy mistake](/guides/recover-from-privacy-mistake). ## Picks - [Silent.link](https://xmr.club/sims/silent-link) — Long-running eSIM paid in crypto with no name on the line: a durable second number you control. - [Walls eSIM](https://xmr.club/sims/walls-esim) — Crypto-paid eSIM for numbers you need to keep for years. - [JMP.chat](https://xmr.club/sims/jmp-chat) — A phone number delivered over XMPP, so it lives apart from your handset and its identifiers. - [BuyUKeSIM](https://xmr.club/sims/buyukesim) — UK +44 number eSIM paid in crypto, no account. ## How to cite Source: xmr.club, "Your phone number is an identity anchor". https://xmr.club/guides/phone-number-identity (CC-BY-4.0). ## Related - https://xmr.club/guides — full guides index (61 guides) - https://xmr.club/methodology — how the directory grades providers referenced in this guide - https://xmr.club/transparency — funding model + editorial firewall - https://xmr.club/data.json — full provider dataset (CC-BY-4.0) ## License CC-BY-4.0. Attribute "xmr.club".