Your phone number is not just a number. It is a key to your identity. It is tied to your name, your bank, your email, your government ID, and dozens of other accounts. When a messenger demands it, they are demanding the one identifier that connects everything about you. beChat doesn't ask for it.
What your phone number reveals about you
A phone number is not a random label. It is a thread that, when pulled, unravels a large part of your identity:
- Telecom contract. Your phone number is registered to a contract with a telecom provider. That contract has your legal name, billing address, payment method, and in most countries a government-issued ID.
- Account recovery. Your phone number is the recovery mechanism for your email, your bank, your social media, your messaging apps, and dozens of other services. Anyone who controls your phone number can potentially reset passwords for all of them.
- Contact discovery. Messengers like Signal and WhatsApp use your phone number to discover who else is on the service by matching your entire address book. The operator learns who you know, even if you never message them.
- Location data. Your telecom provider logs which cell towers your phone connects to, creating a real-time location history. In many jurisdictions, this data is retained for months or years and available to law enforcement.
- Social graph. Your phone number is a node in a social graph that maps who talks to whom. Telecom metadata (who called whom, when, for how long) is collected and available to authorities in most countries.
SIM swapping: the attack that keeps working
A SIM swap (or SIM hijacking) attack is when an attacker convinces a telecom provider to port your phone number to a new SIM card under the attacker's control. Once the port completes, the attacker receives every call and SMS intended for you, including one-time passwords for banking, email, and social accounts.
SIM swap attacks have been used in numerous high-profile cases:
- Cryptocurrency exchange accounts drained (millions of dollars stolen in individual attacks)
- Twitter, Instagram, and other social media accounts hijacked
- Email accounts taken over, giving access to password resets for every other service
The attack works because telecom providers vary widely in how they verify identity before porting a number. Some require only a name and address. Some accept the last 4 digits of a Social Security number. The bar is low, and social engineering is effective.
If your messenger account is tied to your phone number, a SIM swap gives the attacker your messenger account too. beChat accounts are tied to an 8-character PIN and a device fingerprint, not a phone number. A SIM swap cannot take over your beChat account.
Number recycling: the silent threat
When a phone number is deactivated (the owner switches providers, cancels a contract, or dies), telecom providers eventually reassign it to a new customer. This is called number recycling.
If you forget to detach a phone number from an account before it is deactivated, the next person who gets that number may be able to receive SMS-based password resets for your old accounts. This has caused real-world account takeovers, particularly for accounts where the user forgot to update their phone number.
With beChat, there is no phone number to recycle. Your PIN is yours until you delete your account. If you delete it, the PIN is gone and cannot be reassigned to anyone else.
How beChat does anonymous accounts
When you install beChat, the app generates:
- An 8-character PIN. A random alphanumeric code generated locally on your device. Think of it as a gym locker number. It identifies your account to the server, but says nothing about who you are.
- A device fingerprint. A hardware-derived identifier that binds the account to your physical device. This prevents someone from using your PIN on a different phone, even if they learn it.
That is your entire identity on the beChat server. No name, no email, no phone number, no contact list, no location. The server knows which locker you are, not who you are.
You share your PIN with people you want to talk to, the same way you would share a phone number. The difference is that a phone number traces back to your real identity; a beChat PIN does not.
The trade-off: no recovery
Anonymous accounts come with a trade-off: if you lose your PIN, you lose access to your account. There is no phone number to send a recovery code to, no email to send a reset link to. This is intentional. A recovery mechanism that uses a phone number or email would defeat the purpose of anonymous accounts by re-introducing a link to your real identity.
If you lose your PIN, your messages are gone. Your contacts will need to re-add you with a new PIN. This is the cost of true anonymity. If you prefer recoverability over anonymity, Signal or WhatsApp may be a better fit for you.
What this means for you
If your threat model includes any of the following, phone-number-based messengers are a risk:
- SIM swap attacks on your bank, email, or social accounts
- Telecom data breaches exposing the mapping between your phone number and your identity
- Government requests for telecom metadata (who you talk to, when, from where)
- Number recycling after you deactivate a line
- Any adversary who could access your telecom provider's records
beChat eliminates all of these by not collecting a phone number in the first place. The server has no number to hand over, no SIM to swap, and no telecom metadata to log.
Frequently asked questions
Can I use beChat without a phone number?
Yes. beChat never asks for a phone number, email address, or legal name. Registration generates an 8-character PIN locally and pairs it with a hardware-based device fingerprint. Your account is identified only by these two values.
Why does Signal require a phone number?
Signal uses phone numbers as account identifiers because they provide a simple way to verify identity and discover contacts. The trade-off is that a phone number is tied to your real identity through a telecom contract and government ID. It can be SIM-swapped, recycled, or exposed in a breach. beChat uses anonymous PINs instead.
Is a phone number really a privacy problem?
A phone number is tied to a telecom contract, billing data, and in most countries a government-issued ID. It is reused for account recovery across dozens of services, making it a single point of failure. It can be transferred to a new SIM by social engineering (SIM swap), and it can be recycled to a stranger after deactivation. When a messenger requires a phone number, your account is permanently bound to this fragile identifier.
Keep reading
Read about beChat as a European secure messaging app, the full security model, or why SMS is fundamentally broken.