How To Acquire A Burner Phone (Guide)

Biohazard
4 days ago
7 min read

Acquiring A Burner Phone

Here's the complete operational guide to acquiring a burner phone, from planning through disposal.

First: Define What You Need

Before buying anything, nail down the requirements. Different engagement types demand different hardware:

Engagement Type	Phone Requirement	Why
SMS MFA interception	Any Android with SIM slot	Just needs to receive texts
Vishing calls	Good call quality, noise-canceling mic	You'll be on voice calls
Physical SE (decoy)	Looks convincing when pulled out	Visual authenticity matters
Malicious app testing	Specific Android/iOS version	Target app compatibility
Long-term C2 relay	Battery life, stability	Runs 24/7 unattended
WiFi/near-field attacks	Specific chipset (monitor mode, NFC)	Radio capabilities
Forensic/data extraction	Specific model with known exploits	Cellebrite/GrayKey bypass

The most common pentest burner: A factory-wiped, prepaid Android from a big-box store, paid in cash, with a prepaid SIM from a different store. This covers 80% of use cases.

The Purchase Run - Step-By-Step

Phase 1: Preparation (Day Before)

Leave your personal phone at home. This is the single most important OPSEC rule. Your phone's location history, cell tower pings, and WiFi probe requests will place you at the purchase location. Leave it powered on at home doing something normal (streaming Netflix, whatever).

Dress neutrally. Nothing distinctive. Baseball cap, no logos, plain clothes. No bright colors, no unique accessories. You want to be "guy in jeans and gray hoodie" — the most forgettable description possible.

Bring cash. Not $20s from an ATM linked to your bank account. Get cash back from grocery purchases over the prior week, or hit an ATM days before in a different location. You need roughly:

$30-80 for the phone (budget Android)
$10-40 for the prepaid SIM + initial airtime
$5-20 for a basic case (makes the phone look normal)
Total: $50-150 in cash

Scout locations ahead of time. You want:

A big-box retailer (Walmart, Target, Best Buy) for the phone
A DIFFERENT store for the SIM (convenience store, gas station, different retailer)
Both should be in areas without heavy CCTV coverage on the street approaches
Avoid stores near police stations, government buildings, or high-security areas with ALPR cameras

Plan your route. Know which bus, bike, or walking route you'll take. If you must drive, park several blocks away, not in the store lot. License plate readers are everywhere.

Phase 2: Phone Purchase

Go during busy hours — Saturday afternoon, weekday lunch rush. You want to be one face among many.

Which phone to buy:

Best budget burners (cash purchase, big-box stores):

Android:
  - TracFone / Straight Talk devices: $30-50
    (Samsung Galaxy A03, Moto G Pure, Nokia C100)
    These are locked to the carrier but work fine for pentesting
  - BLU phones: $40-80 (unlocked, Amazon or Walmart)
  - Used LG/Samsung from pawn shops: $30-60 (pay cash, no ID required)

Avoid:
  - Anything requiring a credit check or contract
  - iPhone (expensive, harder to anonymize iCloud activation lock)
  - Name-brand flagship phones (unnecessary cost, easier to trace)

At the store:

Walk in, go directly to electronics
Pick the phone — don't browse, don't ask questions, don't engage staff
Buy ONLY the phone. No SIM, no accessories, no extended warranty
Pay cash. If asked for a phone number or email at checkout: "No thanks" and stare at the card reader. If they insist, give a fake local number
Decline the receipt or take it and destroy it later
Leave. Don't stop for anything else in the store

What you just bought: A device whose IMEI is not linked to your name, credit card, or identity. The only link is CCTV footage, which is why you dressed generically.

Phase 3: SIM Purchase

Go to a DIFFERENT store — a gas station, corner store, or pharmacy. These have worse cameras and less attentive staff.

Which SIM to buy:

Carrier	Brand	Cost	Activation	ID Required?
T-Mobile	T-Mobile Prepaid	$10-40	Online or phone	Sometimes asks SSN (skip it)
AT&T	AT&T Prepaid	$10-35	Online or phone	May require ZIP + name
T-Mobile MVNO	Mint Mobile	$15-45	App-based	No ID, needs email
Verizon MVNO	TracFone, Straight Talk	$15-50	Phone or web	Minimal info
T-Mobile MVNO	Ultra Mobile	$10-30	Quick activation	Fake name works

TracFone/Straight Talk SIM kits are the easiest: They're sold at every Walmart, Dollar General, and pharmacy. The $15-25 kit includes a SIM + 30-day plan. Activation requires minimal info — use a fake name and a burner email.

At the store:

Buy the SIM kit with cash
Buy a prepaid Visa gift card with separate cash if you need to top up later (some SIMs require online payment for renewal)
Don't buy anything else
Leave

Phase 4: Activation (Off-Site)

Do NOT activate at home. Do NOT activate near your home. Do NOT use your home WiFi.

Activation location: Public library, coffee shop WiFi, or a park bench using the phone's mobile data (if the SIM comes with starter data). Anywhere that is not your home, work, or any location associated with you.

Activation process:

bash

# 1. Power on the phone for the first time
# 2. Skip ALL setup prompts:
#    - No Google account sign-in
#    - No Apple ID
#    - No WiFi (use cellular if possible, or public WiFi)
#    - No fingerprint/face unlock (use PIN only)
#    - No location services
#    - No backup/restore
#    - No diagnostic data sharing

# 3. Insert SIM
# 4. Follow activation instructions (varies by carrier)
#    - Most have a web portal: activate.tracfone.com, mintmobile.com/activate
#    - Or call the activation number printed on the SIM card

# 5. Provide activation info:
#    - Name: fake, but memorable (you need to repeat it if support calls)
#    - Email: burner email (ProtonMail or Guerrilla Mail)
#    - Address: real-looking fake address in the area code you want
#    - ZIP: match the address
#    - DO NOT provide SSN, real DOB, or anything traceable

# 6. Test: make a call, send a text to verify it works

Critical: When you call the activation line, use the burner phone itself, not your personal phone. The carrier logs the calling number.

Phase 5: Device Hardening

Before using the phone for anything operational:

bash

# 1. Disable all location services
Settings → Location → Off

# 2. Disable Bluetooth and WiFi scanning
Settings → Location → Wi-Fi and Bluetooth scanning → Off

# 3. Disable Google Play Protect / Find My Device
#    These phone home constantly

# 4. Set screen lock to PIN (not biometric — compelled unlock risk)

# 5. Disable automatic app updates, system updates
#    Updates can change behavior and introduce unexpected network activity

# 6. If you need apps, sideload them:
#    - Download APKs on a separate machine
#    - Transfer via USB (never log into Google Play on the burner)
#    - Or use Aurora Store (anonymous Play Store client)

# 7. Set up a VPN or proxy on the device if needed for your engagement
#    Orbot (Tor for Android) if anonymity matters

# 8. Remove bloatware if possible (via ADB from a separate machine)
adb shell pm uninstall -k --user 0 com.facebook.katana
adb shell pm uninstall -k --user 0 com.google.android.apps.maps
# (remove anything that phones home)

The Entire OPSEC Chain

Cash withdrawal → (days earlier, different location)
        |
        v
Personal phone stays home (powered on, normal activity)
        |
        v
Travel to Store A (no personal phone, generic clothing, parked away)
        |
        v
Buy phone @ Store A (cash, no loyalty card, no interaction)
        |
        v
Travel to Store B (different location)
        |
        v
Buy SIM @ Store B (cash, different cash stash)
        |
        v
Travel to activation location (library, coffee shop)
        |
        v
Activate (fake info, burner email, public WiFi)
        |
        v
Harden device (disable tracking, sideload apps)
        |
        v
Device is operational — ready for engagement

Post-Engagement Disposal

When the engagement ends:

Extract all data you need (logs, captured credentials, screenshots). Transfer offline — never over a network.
Factory reset the phone at least twice. Better: flash a clean factory image if you can.
Remove and physically destroy the SIM. Snip it into pieces with scissors. Microwave the metal contact chip for 3-5 seconds (it'll spark — that's fine). Scatter pieces in different trash cans.
The phone itself:
- If you'll reuse it: store it powered off, in a Faraday bag, with no SIM
- If you're disposing: remove the battery, smash the motherboard (drill through the SoC and storage chip), recycle electronics separately
- Never resell, donate, or toss a phone intact that was used operationally
Burn the prepaid gift card if you used one. Don't leave a balance.

Regional Considerations

US: Still relatively easy. Prepaid SIMs at every Walmart/gas station. Some carriers (T-Mobile) have started asking for SSN during activation — just skip it and try another carrier.

EU: Harder. Many countries require ID registration for SIM cards (Know Your Customer laws). In Germany, Italy, Spain, and others, you must show ID to buy and activate a SIM.

Options:

Buy a pre-activated SIM from someone else (secondary market, crypto forums)
Use an eSIM service that accepts crypto (Silent Link, yesim.app)
Cross-border: buy a SIM in a neighboring country with looser laws and roam

UK: ID often required. Pay-as-you-go SIMs from corner shops sometimes skip verification. Try smaller independent shops rather than chains.

Asia/Middle East: Varies dramatically. Some countries (UAE, China) require national ID for all SIM purchases. Others (parts of Southeast Asia) have loose enforcement. Research country-specific laws before attempting.

Everywhere: An international eSIM purchased with Monero from Silent Link or similar services bypasses local ID requirements. The eSIM activates over the internet, no physical store needed.

What Actually Matters Vs. What's Overkill

Actually matters for a real pentest: