OPSEC52 / Week 22 — Foreign SIMs: the number you buy abroad can still carry your name

A SIM bought in another country feels anonymous — cash, a local number, none of your home accounts. But most countries register SIMs to a passport, every SIM reports the phone it sits in, and the carrier logs where that pair travels. The number is new; the link to you may not be.

Threat model: the selling carrier and the state it answers to — SIM-registration laws that bind the number to your passport, IMEI logging that ties a SIM to a specific handset (and every other SIM it has carried), location logs kept for months, and roaming agreements that copy your movements back to your home carrier.

What actually links a “foreign SIM” to you

Three links survive the border, and most travelers only think about the first.

Registration at point of sale. A large and growing share of countries require ID to activate a SIM — a passport scan at the airport kiosk, a photo at the phone shop. That single step binds the number to your legal identity before you ever send a message. “Local SIM” and “anonymous SIM” are not the same thing, and in most of Europe, much of Asia and the Gulf they are opposites.

The handset. Your phone broadcasts its IMEI to every network it joins. Put a new foreign SIM into the phone that carried your home SIM, and the carrier — and anyone with its logs — can tie the two numbers together through the shared hardware. A fresh number in a known phone is a renamed line, not a new identity.

The pattern. Even an unregistered prepaid SIM deanonymizes itself through behavior: it lights up the same cell towers as your hotel, logs into the same accounts, and travels on the same route as a phone the state already knows. Metadata doesn’t need your name when the movement is a fingerprint.

What to do today

• Decide what the SIM is for first. Maps, ride-hailing and restaurant bookings need data, not identity cover — a travel eSIM is fine. A number you intend to keep separate from your legal self is a different job and needs the steps below.
• Separate the SIM from your real phone. For anything sensitive, use a second handset that has never carried your home SIM. One phone, one identity — don’t mix a compartmentalized SIM into the device the state already maps (see Week 7, phone compartmentalization).
• Prefer a data-only travel eSIM for convenience. A travel eSIM bought before the trip — ideally without KYC, paid in crypto (our own eSIM desk exists for this) — gives you connectivity with no passport scan at a foreign counter and no local registration record in your name. Route the sensitive traffic through your own VPN or Tor on top (Week 1, Week 19).
• Know the registration law before you land. If the country registers SIMs to ID, assume the number is bound to your passport from minute one. Plan around it — don’t discover it at the kiosk.
• Keep the voice/SMS number and the data path apart. If you need an SMS-receivable number, get it from a service built for that (a no-KYC SMS number), not from a passport-registered local SIM you then use for everything.
• Turn off your home SIM, don’t just roam on it. Roaming hands your home carrier a running log of every foreign network you touched. If you want a clean break, power the home line down — pulling it, not just toggling data.

For crypto users

Never run an exchange login, a wallet, or a node over a SIM registered to your passport in a country you’re visiting — you’ve handed one carrier the link between your identity, your location and your on-chain activity. If you must transact while traveling, do it over a data-only eSIM (bought without ID, ideally pre-trip) plus a VPN or Tor, on a phone that isn’t your daily driver, and never enter a seed phrase on a device sitting on a network you don’t control.

Common mistakes

• “I paid cash, so it’s anonymous.” Cash hides the payment, not the passport scan. If activation needed your ID, the number is registered regardless of how you paid.
• One phone for the home SIM and the foreign SIM. The shared IMEI quietly welds the two numbers together. A new SIM in an old phone buys you almost nothing.
• Leaving the home line roaming “just in case.” That’s a continuous beacon to your home carrier. Decide before the trip whether the home number travels at all.
• Treating a travel eSIM as identity cover. A data eSIM is great for not leaving a registration trail abroad — but it is not a disguise. Your accounts and your route still identify you unless you tunnel and compartmentalize.

This week’s move

Before your next trip, set it once: a second phone with no home-SIM history, a data-only eSIM bought ahead of time (no KYC, paid in crypto), your VPN with a kill switch, and a decision — written down — about whether your home number powers off at the gate. Land already compartmentalized instead of improvising at a foreign counter.

OPSEC52 is xmr.club’s weekly OPSEC series. Curated by Cyber Satoshi. Series index: /opsec. A complement to — not a replacement for — Sam Bent’s daily #OPSEC365. See also Week 4 (phone isolation), Week 7 (phone compartmentalization), Week 20 (border device searches) and Week 21 (hotel and public Wi-Fi).