Phone-number privacy for journalists and activists (and its limits)
How a separate phone number helps reporters and organisers protect sources and personal lives, and why it does not make anyone anonymous.
By PhoneBorn Team8 min read
Key points
- A separate phone number helps journalists, researchers and activists keep sources, public contact and personal life apart. It doesn't make anyone anonymous.
- Carriers, messaging apps and number providers can all see metadata: who contacted whom, when, and roughly where. In many countries SIM cards are registered to an ID.
- Build your plan around a threat model: who might want to find out what, and what they can realistically access. Pick tools, including numbers, to match it.
Phone numbers sit at an awkward spot in professional security. Sources need a way to reach you. Readers expect a public contact line. Messaging apps that encrypt content still ask for a number to register. Your personal number is linked to your family, your bank and often your government ID.
This guide explains how a separate number fits into a journalist's or activist's security practice, what it protects, and, just as important, what it doesn't. It's written for lawful work: reporting, research, advocacy and organising. It's no guide to evading lawful investigations, and it's no replacement for advice from a digital-security specialist who knows your situation.
Start with a threat model, not a tool
Security trainers keep coming back to the same starting point: before choosing tools, work out what you're protecting and from whom. The Electronic Frontier Foundation's Surveillance Self-Defense guides and the Committee to Protect Journalists' Digital Safety Kit both frame decisions around the specific risks you face, not a one-size-fits-all checklist.
For phone numbers, the useful questions are:
- Who might want to identify your sources? A company you're investigating, a hostile individual, a government agency?
- What can they realistically access? Public data and social media, data brokers, a leaked database, or legal access to carrier records?
- What would they learn from your number? Your identity, your location history, who you talk to?
- What happens if they succeed? Embarrassment, harassment, job loss, legal jeopardy, physical danger?
A freelance reporter worried about trolls needs a very different setup from someone covering a security service in a country with mandatory SIM registration. A second number is a sensible step in the first case. In the second, it's at most one small layer.
What a separate number is good for
| Goal | Does a separate number help? | Notes |
|---|---|---|
| Keep your personal number off public tip lines and bylines | Yes | The classic use case |
| Separate work contacts from family and friends | Yes | Also makes it easier to hand over or retire the line |
| Register an encrypted messenger without exposing your main number | Partly | The app still stores the registration number; check its privacy settings |
| Reduce doxxing and harassment | Partly | Stops the number itself being a lookup key to your personal life |
| Hide who you talk to from the carrier or provider | No | Metadata is still visible to whoever runs the line |
| Hide your location from a well-resourced adversary | No | Device, network and app signals reveal location |
| Make you anonymous | No | See the limits section below |
Public contact and tip lines
Publishing a dedicated number for tips means your personal number never appears on a byline, a website or a social-media profile. When the story ends, or the number attracts abuse, you can retire it without disrupting your personal life.
Encrypted messaging registration
Encrypted messengers protect message content, but many still need a phone number to register. Signal is a good example. Its announcement of usernames is clear that you still need a phone number to register. Signal's support article on phone number privacy explains that the number is hidden by default from people who don't already have it saved. You can also set "Who can find me by my number" to Nobody, so people need your exact username to reach you. CPJ's kit likewise suggests giving out a Signal username instead of a phone number. WhatsApp's usernames FAQ describes optional usernames too, but a phone number is still required to register. A separate number keeps your personal number out of your sources' contact lists and away from anyone they might share it with.
Compartmentalising projects
Some reporters keep one number per long-running investigation, so a compromised phone or leaked contact list exposes one project, not everything. Whether that's worth the admin depends on your threat model.
The limits: what a number can't do
This is the section most "privacy number" marketing leaves out.
Metadata is still visible
Encryption protects what you say. It doesn't necessarily hide that you talked, when, for how long, or from roughly where. Carriers keep call and SMS records. App providers see some connection data. The provider of a second number knows which account holds it. EFF explains in its guide to the problem with mobile phones that carriers can locate a phone by measuring its signal at several towers. It also notes that authorities can get this location data from carriers, and that operators record which SIM card was used in which handset, which undermines simple "burner" setups. CPJ's kit notes that SMS and calls that aren't end-to-end encrypted pass through a local provider, which may collect the content or share it with authorities.
For SMS and regular calls, content isn't end-to-end encrypted at all. Never discuss sensitive matters by SMS or a normal phone call, whatever number you use.
SIM registration ties numbers to identity
Many countries require ID to activate a SIM card, and some also take fingerprints or face scans. Privacy International's timeline of SIM registration laws counted 157 governments with some form of mandatory SIM registration as of 2021. Where that's the law, a local SIM in your name is directly tied to you. Our SIM registration laws by country article looks at which countries require what.
Accounts and payments leave trails
Paying for a number, a phone plan or an app creates records. Paying with crypto limits the payment data a provider holds, but exchanges often know who bought the crypto, and blockchains are public. Our guide to paying for online services with crypto covers the trade-offs honestly.
Your device gives you away
A second number on the same phone as your personal accounts, photos and location services doesn't separate much. If your threat model includes device seizure or targeted spyware, you need device-level measures and expert help, not just another number.
Providers respond to lawful requests
Every legitimate provider, PhoneBorn included, operates under the law and can be required to respond to valid legal process. Our trust and safety page and privacy policy explain what we keep. Don't pick a provider because it promises never to cooperate with anyone. That promise is either false or a warning sign.
A practical setup for most reporters and organisers
For the common case, where the threat is harassment, doxxing or corporate snooping rather than a state agency, this setup is realistic and easy to maintain:
- A dedicated work number that you publish for tips and use for work messaging registration. Keep it for years, not weeks, so sources can find you and accounts stay recoverable. A real mobile number you renew works; a one-time code number doesn't, because you can't receive later log-in codes.
- An encrypted messenger registered with that number, with "find me by number" discovery switched off where the app allows it, and a username shared instead of the number where possible.
- Disappearing messages for sensitive threads, agreed with the source.
- An authenticator app or security key on every account linked to the work number, so SIM swaps and number loss can't lock you out. See our guide to keeping your number for 2FA.
- A retirement plan. Know how you'll hand over or retire the number: who needs to be told, which accounts need a new number, and when you'll stop renewing it.
| Layer | Protects against | Doesn't protect against |
|---|---|---|
| Separate number | Personal number exposure, casual doxxing | Metadata analysis, lawful requests |
| Encrypted messenger | Content interception in transit | Endpoint compromise, contact lists shared by the source |
| Disappearing messages | Message history on seized devices (partly) | Screenshots, compromised devices |
| Authenticator app / security key | SIM swap, number loss | Phishing on some methods, device loss without backups |
| Separate device | Cross-contamination with personal accounts | Network-level location tracking |
Protecting sources
The number is about you, but the stakes are often higher for sources. Tell sources plainly what the channel protects and what it doesn't. Don't ask them to text sensitive information by SMS. Remind them that a messenger contact saved under your name on their phone is itself evidence if their phone is searched. Established newsroom guidance goes further. The Freedom of the Press Foundation's digital security checklist for journalists suggests a separate number to keep your personal number private and, as a further step, a separate phone for reporting. For urgent help, Access Now runs a free Digital Security Helpline for journalists, activists and human rights defenders.
Where PhoneBorn fits, and where it doesn't
PhoneBorn rents real mobile numbers in 200 countries, with SMS and calls, managed from a web dashboard. Sign-up needs only an email address, and payment is crypto-only. That's useful if you want a work number that isn't on your personal SIM, doesn't need a second physical SIM, and can be read from any device.
It is not an anonymity service. We know which account holds a number, we follow the law, and our acceptable use policy forbids harassment, fraud and other abuse. If your threat model includes a state actor, talk to a specialist helpline or your organisation's security team first.
FAQ
Does a second number make me anonymous?
No. It separates your personal number from your work, which cuts down casual exposure. Carriers, app providers and number providers still see metadata, and lawful requests can link the number to its account.
Is SMS safe for talking to sources?
No. SMS and normal calls aren't end-to-end encrypted. Use an end-to-end encrypted messenger for sensitive conversations, and agree on disappearing-message settings with the source.
Should I use a one-time number to register a messenger?
Usually not. If the messenger ever asks you to re-verify, you'll need the same number. Use a number you keep and renew, and add a registration lock or PIN where the app offers one.
Is it legal for journalists to use a separate number?
In most countries, yes, having more than one number is ordinary. Some countries require SIM or number registration to an ID. Check local rules, and see our overview of whether a second number is legal.
What should I do if my work number is doxxed?
Switch off discovery in your messaging apps, tell key contacts about the change through a trusted channel, move 2FA on linked accounts to an authenticator app, and retire the number once accounts have moved.