OPSEC52 / Week 16 — Burner phones: a clean number on a dirty handset is not clean

Most people think a burner is a cheap phone with a fresh SIM. That is the easy 20%. The number is trivial to keep clean; the phone, the way you paid for it, and where you switch it on are where almost every burner is blown. A prepaid SIM bought with cash means nothing if the handset that carries it also carried your real SIM last week, or powers on in your bedroom, or was bought on your card.

Threat model: your carrier and its tower logs, the phone’s baseband (a small always-on radio the OS can’t fully control), whoever holds the purchase trail (card processor, shop CCTV), and any analyst who can correlate two devices by time and place. A burner is four clean things at once — number, handset, purchase, movement — and it fails if any one ties back to you.

The number is the easy part (Week 4 covered it)

A non-KYC prepaid SIM bought with cash gets you a clean number. Good — but a number is one identifier, and the phone around it emits several more. Getting the SIM right and stopping there is the classic mistake: the number is clean and everything else is you.

The handset is a beacon, not a tool

Every phone broadcasts a hardware identity independent of the SIM:

IMEI — a serial the network logs alongside the IMSI (SIM). If your burner SIM and your real SIM ever sit in the same handset, the carrier’s records now link the two numbers permanently. One phone, two SIMs = one person.
Baseband — the cellular modem runs its own closed firmware beneath the OS. Airplane mode and “off” are requests to it, not guarantees. Treat any powered handset with a battery as potentially locatable.
Wi-Fi / Bluetooth MAC + sensors — even with no SIM, a phone probes for networks and can be fingerprinted. A burner that ever joins your home Wi-Fi has geolocated itself to your address.

So: a burner needs its own dedicated handset that has never held your real SIM and never touches your networks — not your old phone with a new card.

The purchase trail

Buy the handset and the SIM the same way you’d want them to stay anonymous: cash, in person, not on camera you can be tied to, not near home. A burner bought on your card — or ordered to your address — is pre-linked before it’s ever switched on. Same for top-ups: cash vouchers, not a card.

Co-location is what actually blows burners

This is the one people miss. Carriers (and anyone with the tower data) run co-location analysis: two phones that repeatedly power on in the same cell at the same times, then travel together, are almost certainly one person. If your burner is ever powered on:

in your home or workplace, or
at the same time and place as your real phone,

…it doesn’t matter how clean the SIM was — the pattern welds them together. Leave your real phone home and on when you carry the burner; never let both be live in the same place.

The discipline

Dedicated handset, cash-bought, never carried your real SIM, never on your Wi-Fi.
Cash for the phone, the SIM, and every top-up. Not near home, not on your own CCTV.
Never co-locate. Real phone stays elsewhere (ideally home + powered on as an alibi) when the burner is live.
Power off + battery out when not in active use — a live baseband is a beacon.
One purpose per burner. Don’t let a single burner bridge two separate activities, or it becomes a join key just like a reused account.
Retire cleanly. When done, power off, remove/destroy the SIM, and stop using that handset — don’t “recycle” it into normal use where it meets your real identity.

Common mistakes

New SIM, old phone. The IMEI already knows you; the carrier already paired it with your real IMSI.
Charging or switching it on at home. Instant geolocation to your address, plus co-location with your real phone.
Buying it on a card / shipping to your address. The purchase trail links it before first boot.
Carrying both phones together. The whole point is defeated — they travel as a pair.
Logging into a real account “just once” on the burner. That single login binds the handset to you forever.

Burner phones — a clean number on a dirty handset is not clean