Everyday Privacy
Masked Phone Numbers and VoIP for Privacy
The short version
A masked number is a second line that forwards to your real one. You give it to shops, apps, landlords and web forms so your carrier number stops spreading. It is the single best way to slow down robocalls and to break the phone-to-identity link that data brokers rely on. What it will not do: undo the exposure you already have, or replace your real number for two-factor codes, because federal identity guidelines tell verifiers not to send security codes to VoIP lines. Use a mask going forward, keep one clean carrier line for security, and opt out of the reverse-lookup sites that already list you.
What a masked phone number actually is
A masked phone number is a second, disposable number that rings through to your real one. You hand it to shops, apps, landlords and online forms, and they store the mask instead of your carrier line. If it starts attracting spam or turns up in a breach, you delete it and issue a new one without changing the number your family uses.
That makes it different from a burner phone. There is no second handset and no second bill to manage - calls and texts land in the same place they always did. The only thing that changes is which number the outside world writes down about you.
The privacy value is not secrecy. It is compartmentalisation: the number your dentist has is not the number your bank has, so a leak from one does not follow you into the other.
Why your phone number became an identity key
Your mobile number is now the closest thing most Americans have to a national ID number. It is the recovery route for your email, the delivery address for one-time codes, and the join key data brokers use to stitch separate records into a single profile. That is an enormous amount of weight resting on ten digits you give away without thinking.
Because it is stable and unique, a phone number is the perfect linking field. A marketing file with your number and an old address can be matched to a breach dump with your number and a password, and the two become one richer record. Email addresses change; people keep the same mobile number for a decade.
That is also why reverse phone lookup sites are so damaging. A search on your name might return nothing while a search on your number returns your name, your age and your address history - which is the whole point of sites like the ones behind our USPhoneBook opt-out guide.
The three practical ways to get a second number
There is no single best answer here, only trade-offs between cost, convenience and who you are trusting with your call records. Most people land on one of three options, and it is perfectly reasonable to combine them - a free number for low-stakes forms, a paid mask for anything you might want to burn later.
- Google Voice. Free for personal use in the US, with free calls to the US and Canada when you are calling from the US. Setup needs a phone that can receive a verification text, and you are trusting Google with the metadata.
- A paid masking service. Mozilla's Firefox Relay, for example, sells phone masking as a premium feature available in the US and Canada, alongside its email masks. Paid services usually let you rotate or discard a mask cleanly.
- A second prepaid line or eSIM. More expensive and more hassle, but it is a genuine carrier line, so it works everywhere a VoIP number gets refused.
Some marketplaces already do this for you: delivery and rideshare platforms often proxy calls so neither side sees the other's real number. That is the same idea, applied narrowly.
Where the Do Not Call Registry stops helping
People often try the National Do Not Call Registry first and conclude that nothing works. The registry is worth using, but it only binds legitimate telemarketers. It is not aimed at the scam operations behind most of the calls that actually bother you, and registrations have grown every year without the calls stopping.
| Fiscal year | Active Do Not Call registrations (US) |
|---|---|
| 2021 | 244,302,202 |
| 2022 | 246,820,600 |
| 2023 | 249,498,621 |
| 2024 | 253,721,138 |
| 2025 | 258,515,050 |
Source: FTC, National Do Not Call Registry Data Book 2025 (December 2025). Active registrations at each fiscal year end.
The FTC is blunt about the limits: sales robocalls are illegal whether or not your number is on the registry, unless the caller has your written permission. In other words, the callers breaking the law were never going to check the list. Register anyway - it takes a minute - but treat controlling who gets your number as the real defence. Our guide to stopping spam calls and texts covers the rest of the stack.
The VoIP catch: why some sites reject your second number
This is the part that catches people out, so it is worth knowing before you start. Many banks, brokerages and government portals will refuse a Google Voice or masking-service number outright. That is not a bug or an accident - it follows directly from the federal guidance those organisations are built around.
NIST's digital identity guidelines (SP 800-63B) state that methods which do not prove possession of a specific device, such as voice-over-IP or email, must not be used for out-of-band authentication. The same section tells verifiers to consider risk signals like a SIM change or number porting before sending a code over the phone network at all.
The practical rule that falls out of this: keep one real carrier number, give it to almost nobody, and use it only for security. Use the mask for everything else. Better still, move your important accounts to app-based codes or passkeys so the phone network is not part of your login at all.
What masking does not protect you from
A mask is a forward-looking control. It stops new exposure; it does not retract the exposure you already have, and it does not harden the carrier line underneath it. Two threats in particular survive a second number, and both need their own fix.
The first is SIM swap and port-out fraud, where someone convinces a carrier to move your number to their device or their account. In November 2023 the FCC adopted rules requiring wireless providers to authenticate customers securely before redirecting a number, and to notify customers immediately when a SIM change or port-out request is made. Set a carrier account PIN and read our walkthrough on defending against SIM swaps.
The second is the historical record. Every copy of your real number already sitting in a broker file, a breach dump or a reverse-lookup listing stays there. A mask changes what happens next, not what already happened.
Your real number is probably already published
Before you decide masking is enough, check what is already out there. Reverse phone lookup sites hold your number next to your name, age, address history and relatives, and they are keyed to the number itself - so they surface you even when a name search comes up empty. This is the exposure a new mask cannot touch.
Start with a free exposure scan to see which brokers are likely to list you and whether your details show up in known breaches. Nothing you type into it is stored.
Then work the phone-keyed sites specifically. Our NumberGuru opt-out guide is a good example of the pattern: the removal request routes through a parent company, takes about five minutes, and needs an email confirmation. For the wider job, see how to remove your phone number from the internet.
A setup that takes one afternoon
You do not need to rebuild your digital life. The goal is simply to sort your numbers into two piles - one private, one public - and then stop the public pile from growing. Working through it in one sitting is realistic for most people.
- Pick your mask. Create a Google Voice number or sign up for a masking service, and save it somewhere you can copy from quickly.
- Declare your carrier line private. From today it goes to family, your bank, and your employer. Nothing else.
- Swap the mask into low-stakes accounts. Retailers, loyalty schemes, delivery apps, appointment bookings, newsletters, marketplace listings.
- Move two-factor off SMS. Use an authenticator app or a passkey wherever it is offered, so a compromised number is not a compromised account.
- Lock the carrier account. Set a PIN or passcode with your provider, and turn on any port-out or number-lock protection it offers.
- Clean up the back catalogue. File opt-outs with the reverse-lookup sites that already list your real number.
Step six is the one that keeps coming back. Brokers re-ingest public records continuously, so listings you remove can reappear within a few months. You can have RedactZero re-check monthly and email you only when something new turns up.
Which option fits which person
If you are mainly trying to stop giving your number to every shop that asks, a free VoIP number is enough and costs you nothing but setup time. If you expect to hand out numbers you will later want to destroy - marketplace listings, dating apps, one-off contractors - pay for a service that lets you rotate masks cleanly.
If your threat model involves a specific person rather than a marketing pipeline, a second carrier line is the stronger choice, because it works everywhere and does not depend on one company's forwarding service staying online. Anyone in that situation should also read our notes on everyday privacy and treat address removal as the higher priority.
The same compartmentalising logic applies to your inbox, and the tooling there is better and cheaper - see email aliases for privacy if you have not set those up yet.
When a masked number is the wrong tool
Masking is a poor fit anywhere a specific, verified line is genuinely required. Financial and medical account setups, some government services, and certain employment checks will reject VoIP numbers or fail in ways that cost you real time. Fighting that is not worth it - use your carrier line and move on.
It is also the wrong tool if you are trying to fix a problem that has already happened. If your number is being used against you right now, removal requests and carrier-level locks do more than a new forwarding number will. And if you are in an urgent safety situation, a fresh carrier number plus targeted broker removals beats a mask layered on top of an exposed line.
One last practical warning: do not let a mask become a single point of failure. If a forwarding number lapses or a service shuts down, it gets reassigned to a stranger, and anything still pointing at it for password resets goes with it.
See where your number already appears
Run a free exposure scan to see which data brokers likely list you, plus any breaches tied to your email - no account, nothing stored.
Frequently asked questions
What is a masked phone number?
A masked phone number is a second number that forwards calls and texts to your real one. You give the mask out instead of your carrier line, so the businesses, apps and forms that collect it never store the number tied to your name and your bank.
Is Google Voice a good privacy number?
For most people it is the easiest starting point. Google Voice gives US users a free number, and calls to the US and Canada are free from the US. The trade-off is that you are handing your call and text metadata to Google, and setup requires a phone that can receive a verification text.
Can I use a VoIP number for two-factor authentication?
Often not, and by design. NIST's federal digital identity guidelines say methods that do not prove possession of a specific device, such as voice-over-IP or email, must not be used for out-of-band authentication. Many banks follow that rule and reject VoIP numbers, so keep a real carrier line for security codes.
Does a second number stop robocalls on my real number?
No. A mask stops new exposure; it does nothing about the copies of your real number already circulating. Existing robocalls keep coming until those listings age out or you get them removed. The mask is how you stop the problem getting worse.
Will a masked number protect me from a SIM swap?
Only indirectly. A SIM swap targets the carrier line your codes go to, and a mask does not change that line. It helps by keeping your real number out of circulation, so an attacker has less to work with. Add a carrier account PIN and app-based two-factor codes for the actual protection.
Do I still need to opt out of people-search sites if I use a masked number?
Yes. Reverse phone lookup sites already hold your real number next to your name and address history, and a new mask does not delete those records. Opt out of the phone-keyed sites separately, then use the mask so the next batch of records has nothing to ingest.
Is it legal to give a business a masked number?
Yes. A masked or VoIP number is a real, working number that reaches you - you are choosing which of your numbers to share, not falsifying anything. The exception is any context where a specific verified line is required, such as certain financial or medical account setups.
What happens to my masked number if I stop paying for it?
It is released and eventually reassigned to someone else, which means anything still using it for recovery codes can end up in a stranger's hands. Before you drop a mask, change it out on every account that has it, especially anywhere it is used for password resets.
Sources: NIST Special Publication 800-63B, Digital Identity Guidelines (out-of-band authentication and VOIP); FCC, "FCC Adopts Rules to Protect Consumers' Cell Phone Accounts", November 15, 2023 (SIM swap and port-out fraud); FTC, National Do Not Call Registry Data Book 2025, December 2025; Google Voice Help; Mozilla, Firefox Relay support documentation.