How to Keep Your Phone Number Private When You Sign Up

The Short Read

Your real phone number is a permanent identifier that gets sold to data brokers, fed into spam lists, and is the first thing a stranger asks for when you sign up for almost anything. You do not have to give it out.

The default for any signup that is not your bank, your employer, or your doctor is a second number on a VoIP or data-only app. For the people and accounts that need a real SIM, you lock the SIM against port-out. For the calls and texts that still get through, you run carrier-level call screening and you register on the Do Not Call list. The FTC's page for its FY 2025 Do Not Call data book reports more than 258 million active registrations on the Registry.^[1] The same page records more than 2.6 million Do Not Call complaints in that fiscal year.

None of this is theoretical. The FTC reported on April 16, 2025 that consumers reported losing $470 million in 2024 to scams that started with a text message, five times the amount reported in 2020.^[2]

Why your real phone number is a liability

The phone number is one of a small list of identifiers that follow you across services and cannot be rotated easily. Your name is fuzzy. Your email can be aliased. Your phone number is the one piece of information that a stranger on the phone, a credit application, and a data broker all treat as the same person.

That makes it valuable in three directions at once.

Data brokers and people search sites. Your number ends up in the same profiles that link your address, your relatives, and your email. Once it is in a people-search file, removing it is the same project as removing the rest of your data. The site already has guides for the data broker opt-out process and the people-search removal workflow.
Scammers and SIM swappers. A working number is a target for SIM swap fraud, the attack where a scammer gets your number moved onto a SIM card they control and then receives the text-message verification codes for your accounts. The FTC's October 2019 consumer alert explains how the scam works and how to protect yourself.^[3]
Robocallers and text scammers. The FTC's April 2025 release reported the $470 million 2024 figure alongside the most commonly reported types of text scam: fake package delivery alerts, phony job offers, fake "fraud alert" messages, fake unpaid tolls, and the "wrong number" scams that try to start a romance or investment pitch.^[2]

None of these threats require a hacker to compromise your phone. They all start with one quiet moment where you typed a number into a checkout form or a sign-up page.

The four numbers most people actually need

Most readers do not need a single number. They need a small set of them, each with a specific job.

Your real, SIM-based number. Held back for the things that actually need it: your bank, your doctor, your employer, the 2FA on your primary email and password manager. This number should be on a SIM that has a port-freeze and an account PIN. You do not give it to a checkout form, ever.
A second number for accounts and shopping. Used for retail sign-ups, food delivery, loyalty programs, app stores, anything that texts you a code or wants to "verify" you. If this number gets spammed, you change it. Your real number does not move.
A second number for dating, classifieds, and short-term use. A number you can hand out in person, on a dating profile, or on a marketplace listing. When the situation ends, you delete the number.
A second number for selling or public listing. A number on a public profile, a business card, or a web form that you expect to get hit by bots.

You can collapse these four into two. You cannot collapse them into one and still have any privacy.

Pick the right tool for the second number

Three mainstream categories cover most of the use cases above. The choice depends on what you are willing to pay, where the number needs to work, and how paranoid you are about the provider.

Google Voice (free basic plan)

Google Voice is a cloud-based phone service that gives you a phone number for calls, texts and voicemail, used through the Google Voice app or the web; in the US you can choose your own number. The Google Voice product page offers a basic plan at no cost plus paid Starter, Standard and Premier plans.^[4]

For the "second number for accounts and shopping" job, Voice is the default. The basic plan costs nothing, it texts, and it does not require a second SIM.

The trade-off is that Voice is a Google product, and Google's privacy policy applies to the call metadata and contact data the service handles. The number is not anonymous in the absolute sense: it is tied to a Google account that is itself tied to a name and a payment method when you add a paid line. For most sign-ups, that is fine. The point of the second number is to insulate your real number from spam, not to disappear from Google's view.

Google Voice does not offer 1-800 numbers. When you call from the US, almost all calls to the US and Canada are free, and some calls to specific numbers cost 1 cent per minute.^[5] Google Voice is fine for sign-up codes; it is not a substitute for a real phone in a safety-critical context.

Second-number apps (MySudo, Hushed, Burner)

If Google Voice is the default, dedicated second-number apps are the alternative. The high-level shape of the trade-off is:

MySudo is built around a "Sudo" identity model: you create multiple Sudos, each with its own phone number, handle and email address, and the suite also lists virtual cards. MySudo pitches Sudos for sign-ups, downloads, shopping and work.^[13]
Hushed sells second and temporary phone numbers for calling and texting in one app.^[14] It suits a temporary number you can drop when a marketplace listing closes.
Burner sells extra numbers on a subscription that includes calls and texts and lets you delete or switch numbers.^[15]

Prepaid phones and "real" second SIMs

For readers who want a real, SIM-based second line that does not run through a Google or a third-party app, a prepaid phone on a separate carrier is the move. The number is a real number in the North American Numbering Plan, the calls and texts work everywhere, and there is no app vendor in the loop.

The trade-offs are cost, friction, and a need to keep the prepaid line active. Carriers deactivate prepaid lines that go unused for an extended period; the exact window depends on the carrier and the plan.

A prepaid second line is also the right choice if you are switching carriers, traveling, or trying to keep your work number and personal number on different billing accounts for tax or legal reasons.

What "masking" the number actually means

Some signup flows do not need a real, reachable number. They want a number-shaped string that passes a regex and a confirmation step. That is a different problem, and the right tool is a temporary or disposable number service that gives you a number for a few minutes or a few days, then lets the number expire.

The honest version of this:

For the one-time verification code on a sketchy retail site, a disposable number service is fine. If the site sells the number to a spam list, the number is already dead by the time the spam starts.
For the account you plan to use for more than a month, a disposable number is wrong. When the disposable expires, you lose the ability to receive password resets and the account becomes inaccessible. Pick a number you can keep.
For a real account on a service that requires ongoing SMS (a rideshare app, a financial account, a workplace 2FA), a permanent second number on a VoIP service that supports ongoing SMS is the right answer. Do not use a disposable here.

Free web tools that let you read a public number's SMS inbox are a real attack surface. Anyone who knows or guesses the number can read the code. The two minutes of convenience are not worth the risk on anything that touches money or identity.

Lock the SIM you keep

For the real, SIM-based number you do keep, the threat is SIM swap. The FTC's consumer guidance on SIM swap scams describes the attack as a scammer telling your carrier your phone was lost or damaged and asking it to activate a new SIM card connected to your number on a phone the scammer owns. The scammer then gets your texts and calls, including the verification codes for accounts that use text messages for multi-factor authentication.^[3]

The defenses are all carrier-side. You do not need any app.

Set a unique account PIN with your carrier, not your date of birth, not the last four of your SSN, not the same PIN you use on a banking app. It is the extra check a carrier can ask for before an account change.
Ask for a port-out freeze or number lock. AT&T, Verizon, and T-Mobile all offer a version of this; the site's SIM swap guide covers each carrier's setting. With a port-out freeze on the number, an attacker who calls pretending to be you cannot move the number to a new carrier without the freeze being lifted first.
Enable a SIM PIN on the device side. The PIN is then needed to use the SIM card after a restart or in another phone, which protects a lost or stolen SIM. It does not stop a carrier-side SIM swap.
Move the most important 2FA off SMS. The same number that is your password reset channel should not also be your only 2FA channel on a financial account. A hardware security key or an authenticator app breaks the chain.

None of these are substitutes for the others. The account PIN makes an account takeover harder. The port-out freeze blocks a number transfer while it is on. The SIM PIN protects the physical card. The non-SMS 2FA stops a successful port-out from being enough to drain the accounts.

Stop the calls and texts that still get through

Even with a second number and a locked SIM, some calls and texts will arrive. The right tools are at the carrier level and at the OS level.

Register on the National Do Not Call Registry at donotcall.gov. Registration is free, and the Registry tells telemarketers that follow the law which numbers not to call; it does not stop calls from scammers.^[12] The FTC's FY 2025 data book records more than 258 million active registrations on the list and more than 2.6 million Do Not Call complaints in that fiscal year.^[1]
Enable carrier-level call screening. AT&T, Verizon and T-Mobile each offer a free spam-call tool. Verizon's Call Filter service, for example, screens incoming callers to alert you if a number may be spam, a robocall, or fraud, and forwards high-risk spam calls to voicemail.^[8] AT&T offers a comparable mobile-security app under the ActiveArmor brand, free with every AT&T wireless plan, with paid tiers that add identity protection such as dark web monitoring.^[9] T-Mobile's ScamShield app comes in free and premium versions and can block suspected scam calls automatically with Scam Block.^[11]
Use the OS-level spam filters. On iPhone, Settings, then Apps, then Phone or FaceTime lets you screen or silence calls from numbers not saved in your contacts (silenced calls go to voicemail), and a spam filter under Call Filtering sorts suspected spam into its own list.^[10] Android phones have their own call-screening and spam settings; the path depends on the device maker.
Forward scam texts to 7726 (SPAM). The FTC's April 2025 release lists this first in its advice on handling text scams.^[2] The FTC says it helps your wireless provider spot and block similar messages.
Report what slips through to ReportFraud.ftc.gov. The FTC's April 2025 release also advises reporting scam texts to the FTC at ReportFraud.ftc.gov.^[2]

Under FTC rules the Registry still allows political calls, charitable calls, debt collection calls, purely informational calls and surveys, as long as they carry no sales pitch. A robocall that sells something is illegal unless the seller has your written permission, whether or not your number is on the Registry.^[12]

What STIR/SHAKEN does and does not do for you

STIR/SHAKEN is the framework the FCC required voice providers to implement so that the caller ID information on a call can be authenticated and verified, not just displayed. The FCC's Call Authentication page documents the original June 30, 2021 deadline for implementation in the IP portions of voice service providers' networks.^[6]

What that does for a reader: the calls that show up with a "Scam Likely" or "Spam Risk" label come from carrier labeling, and the FCC says caller ID authentication supports providers' blocking decisions and call labeling efforts. The label is not perfect.

What STIR/SHAKEN does not do:

It does not stop a scammer calling from a real number. The framework checks that caller ID information is accurate, not that the caller is honest.
The FCC describes it as a framework for calls carried over IP networks. Text messages are outside it.
It does not stop a SIM swap or a port-out. The framework is about call identity, not about subscriber identity. The lock-the-SIM steps above are separate.

There are penalties on the books for caller ID spoofing. The Truth in Caller ID Act makes it illegal to transmit misleading or inaccurate caller ID information "with the intent to defraud, cause harm, or wrongfully obtain anything of value," with penalties of up to $10,000 per violation. In a January 13, 2017 forfeiture order, the FCC imposed $25,000 for 31 spoofed calls made in a harassment and stalking campaign, some of them showing the numbers of prisons, including a New York maximum security prison. Full liability under the statute would have been $310,000; the order says the amount already reflected a discount for a first-time violation.^[7]

What about the data broker trail?

The number is a piece of the profile, not the whole profile. The same data brokers that sell your address and your relatives also sell your number, and they link the three together. A second number is the cheap fix. Removing your real number from the broker files is the slow fix.

The site's existing data broker opt-out guide walks through the per-site deletion requests. The people-search removal guide covers the major people-search sites. A second number keeps new signups from re-feeding the brokers. The opt-out process starves the existing records. Both are worth doing.

If you run a business and your real business number is already in the broker files, the same playbook applies. Add a tracking number for the public-facing work, push the real line to voicemail, and route only known contacts through it.

The 30-minute setup

Pick a second-number app. The Google Voice basic plan costs nothing; Hushed, MySudo and Burner are the dedicated alternatives. The choice is how many separate identities you want and how compartmentalized the design needs to be.
Provision a second number. Add it to your phone. Set its voicemail to a separate greeting so a return call to the wrong number does not surface your real one.
Audit the last month of signups. For every account where you used your real number, change it to the second number if you still have access, or replace the account if you do not.
Set a unique account PIN with your wireless carrier. Ask for a port-out freeze on your real number. Enable a SIM lock on the device.
Move 2FA off SMS for the accounts that matter. Authenticator app or hardware key for the password manager, the primary email, and the financial accounts.
Register on the Do Not Call Registry at donotcall.gov if you have not already.
Enable carrier call screening and the OS-level spam filter. Forward any scam text that slips through to 7726 and report the rest to ReportFraud.ftc.gov.

The bottom line

Your real phone number is the one identifier that crosses every boundary between your accounts, your data-broker profile, and the people trying to reach you without your consent. The fix is not paranoia. The fix is a small set of numbers, each with a specific job, and a SIM that is locked against the only attack that really matters. A free second number and a 30-minute carrier call are most of the work. The rest is habit.