IMPORTANT: While this article focuses on Mexico’s governmental surveillance overreach in forcing the registration of prepaid phone lines, the information herein can be applied no matter where you are, on both sides of the Atlantic.
Alright lads and lasses. I’ve been asked to put this together because it can’t be “safely” done from within Mexico. It’s a feckin’ rabbit hole, so you’ll need to be thorough in reading it and then do your own research.
Sasch tells me the membership system will be live next week, so we’ll get a more in-depth guide for this put together for members.
Anyway, I’ve been fighting for freedom online and offline for many decades now. I’ve tracked the European Union’s technocratic creep from the 1990s onward, Canada’s more recent population controls, and the rapid capture of Washington by corporate and foreign interests.
Yet I’ve rarely encountered a clearer control and surveillance pattern than the one now unfolding in Mexico right now. What you you have is a mandatory linkage of every prepaid mobile line to an official identity. It’s presented as a “narrow anti-crime measure” but it actually functions as yet one more massive brick in the global architecture of mass-surveillance and population control that’s unfolding all around us.
What’s Happening
The Commission Reguladora de Telecomunicaciones (CRT) guidelines, published in the Diario Oficial de la Federación on 9 December 2025, require every Mexican-issued prepaid line to be associated with a CURP and official photographic identification.
Linking began on 9 January 2026. After low compliance the original 30 June deadline was replaced by a staggered calendar running from 15 August to 31 December 2026 according to the final digit of the number.
Unregistered lines are then suspended within seventy-two hours of their assigned date. Post-paid contracts were already linked and are thus exempt. Foreign-issued SIMs and eSIMs that merely roam on Mexican networks remain exempt because they are not Mexican lines and therefore beyond the Mexican government’s control.
However, this is not a purely Mexican initiative.
Mandatory SIM registration now exists in more than 160 countries. The same international bodies and technology consortia that promote digital identity frameworks, eSIM standards and “trusted connectivity” have spent years normalising the idea that “an anonymous communications endpoint is inherently dangerous.“
Mexico’s programme is just one regional implementation of a coordinated global shift that treats every mobile number as a persistent identity token.
What Ordinary People Can Still Do, And The Limitations
A fully anonymous Mexican prepaid number is no longer available. Registering under false documents or another person’s identity without their knowledge is identity fraud and creates additional legal exposure, especially for expatriates. The practical options that remain are therefore quite limited.
Any Mexican-operator-issued line that stays active after the December 31st deadline remains permanently associated with a CURP held by that operator. The ID association enables correlation of call-detail records, SMS metadata and, where retained or requested, location data with a named individual. It can also be cross-referenced with other government systems that already key on the CURP.
The only durable reductions in exposure come from moving the bulk of actual communication off that line and onto encrypted channels that do not depend on it, and from treating any remaining Mexican number as a high-visibility surveillance channel used only when unavoidable.
Foreign Data eSIMs and Virtual Mexican Numbers
Foreign data eSIMs remain one of the cleaner ways to keep mobile internet without creating a Mexican-issued line that must be linked to a CURP. Services such as Airalo, Holafly, and Nomad sell travel data packages that activate over the air, if you have a compatible handset. Most are data-only, carry somewhat higher per-gigabyte costs than local prepaid plans and are subject to fair-use rules that can limit permanent roaming if you’re a heavy user.
However, they do not give you a Mexican phone number. In practice this means you retain internet access for applications and browsing while your local prepaid line, if left unregistered, is suspended. The eSIM does not protect or resurrect a Mexican number; it simply supplies an alternative data path and a way to get a new number.
Once a data eSIM is active, two virtual-number services can supply a Mexican-looking number that is not a CRT-linked local prepaid line. Both operate over the data connection the eSIM provides. Neither is a native Mexican mobile subscription, so neither triggers the CURP-linking obligation that applies to lines issued by Mexican operators.
MoreMins and PrivacyNumber: Pros, Cons and Practical Uses
MoreMins sells virtual phone numbers for more than fifty countries, including Mexico, that function inside its own application. The Mexico virtual number is currently listed as $83.88 per year. Incoming calls are free; outgoing global rates are low. No physical SIM is required and there are no roaming fees on the virtual number itself. The service is prepaid with no long-term contract. Registration does not require a Mexican CURP.
The process once you have a data eSIM: download the MoreMins app, register an account, purchase the Mexico number through the e-shop or app, and the number appears in the application. Calls are handled inside the app over the data connection supplied by your eSIM.
Pros:
- Dedicated app
- Relatively low monthly cost
- Free incoming calls
- Works worldwide over any data connection
- No Mexican identity document required.
Cons: MoreMins Mexican numbers cannot receive SMS. You need a USA or Canadian number for that. Many banks and government portals still reject or restrict virtual numbers. The number exists only inside the MoreMins application, so you must keep the app installed to place or receive calls.
PrivacyNumber provides real local mobile or landline numbers in 47 countries, including Mexico (+52), with no KYC (Know Your Customer). Payment is crypto-only. The number is anonymous and managed entirely through a web panel; there is no dedicated app and no eSIM tied to the number. Click here for Mexico details.
Process once you have a data eSIM: Open a browser, go to the “get number” page, select Mexico, choose a number, pay in crypto, and the line appears in the web panel within about sixty seconds. All calls, SMS, MMS and voicemail are handled through that panel over the data connection from your eSIM.
Pros:
- No identity documents
- Crypto payment
- Real local Mexican numbering
- Works for Whatsapp and other platform verification
- Web-panel access from any browser
- Optional caller-ID masking and other features
Cons: PrivacyNumber has no app, so you need to configure a permanent browser instance on your phone’s home screen. Then you need to be in the control panel to make and receive calls. Outbound calls are metered on top of the subscription, albeit at very low rates. Because everything happens inside the browser panel, incoming calls and messages require the panel to be open or the browser to be able to surface notifications. This needs to be pre-configured on your smartphone, which is something we’ll tackle separately once we’ve tested this setup.
Both services keep the majority of traffic off a CURP-linked Mexican operator line. The data path is foreign; the voice/SMS path is application or panel-mediated rather than through a native Mexican mobile subscription.
In daily use this means you can receive the occasional verification code or place a call that needs to appear Mexican without ever activating a locally traced prepaid line. You can also keep your existing Whatsapp tied to a Mexican number without having to worry about your old number being reassigned by the carrier. The practical constraint is that both still rely on the data connection from the foreign eSIM (or Wi-Fi), and both remain subject to the acceptance policies of the banks, government portals and messaging platforms you actually need to use. Here PrivacyNumber beats MoreMins hands down, despite the more complex implementation path.
Why An Encrypted Device Changes The Equation
Even a registered Mexican number loses most of its surveillance value when it is used on a fully encrypted, hardened device. The operator still holds the association between the number and the CURP. What the operator and, by extension, any requesting authority no longer receive is the content of communications, the detailed app activity, the sensor data, and the rich behavioural profile that a stock Android or iOS device continuously generates.
A registered number tied to a GrapheneOS phone running a hardened privacy setup and private communications applications takes the majority of usable surveillance off the Mexican government’s practical radar. The number itself remains a linkable identifier. The device and the applications on it do not. Metadata such as the fact that a call or data session occurred may still be visible to the operator; the content of that session and the majority of on-device telemetry are not.
GrapheneOS and a Hardened Privacy Setup
GrapheneOS is a privacy and security-focused mobile operating system built on the Android Open Source Project. It is designed for Pixel devices and provides verified boot, strong sandboxing, hardened memory management, and a series of privacy improvements that stock Android deliberately omits. Installation is performed through the official web installer or the documented command-line method at grapheneos.org/install. The project’s documentation and community support are at grapheneos.org.
On a GrapheneOS device the recommended baseline includes:
- Using the built-in Vanadium browser and avoiding Google Play Services entirely, or running them inside the sandboxed compatibility layer only for the few applications that absolutely require them.
- Installing Signal (or something spicier) and configuring it with registration lock, disappearing messages, and a strong PIN.
- Routing internet traffic through a no-logs VPN such as Mullvad or ProtonVPN where jurisdictionally still permitted.
- Disabling unnecessary sensors, location services, and network location where possible.
- Keeping the device updated and verifying the boot chain (Advanced.)
The result is that even when the phone is attached to a CURP-linked Mexican number, the operator and any downstream authority obtain far less actionable intelligence than they would from the same number on a stock Android or iPhone device. Metadata still exists, but content, app telemetry, and most behavioural records do not.
In practice this means the registration programme can still identify which number belongs to which CURP, yet it cannot easily extract the content of encrypted messaging sessions, the detailed application activity, or the continuous sensor and location stream that stock operating systems generate and track by default.
A useful analogy here is the ordinary bank account.
The account itself is wholly tracked and traced. Every transfer, every balance enquiry, every direct debit is 100% visible to the institution and, by extension, to any authority that can compel insight into its records.
Yet if the account holder withdraws cash and uses that cash for the majority of daily purchases, the surveillance state and big-tech intermediaries lose any overview of what is actually being bought.
The registered number on a GrapheneOS device functions in much the same way. The number remains a linkable identifier held by the operator. The content of communications, the applications used, and the bulk of on-device activity do not. The registration requirement is satisfied; the expected usable surveillance is rendered impotent.
Connecting the Threads: From Local Registry to Global Control
Mexico’s programme sits inside a larger pattern. The same year that the CRT issued its guidelines, multiple countries tightened SIM registration rules, expanded digital identity requirements, and accelerated infrastructure that makes remote provisioning and revocation easier. International industry bodies celebrate the growth of “trusted” connectivity standards.
The language is consistent: Anonymity equals risk; identification equals safety.
The practical outcome is a world in which every communications endpoint is expected to resolve to a named individual whose data can be correlated across financial, travel, health and social systems.
The earlier Mexican biometric registry (PANAUT) was struck down by the Supreme Court in 2022 precisely because it created a permanent surveillance architecture without adequate safeguards. The current non-biometric version has already generated more than a thousand amparo challenges (see below).
Specialised telecommunications courts are now tasked with reviewing them. The legal fight continues, but the operational reality for ordinary people is already here.
The combination of a foreign data eSIM, a virtual number that is not a local prepaid line, and a hardened device does not eliminate the existence of the registry; it simply reduces the volume and quality of usable data the registry and its associated operators can collect from any single individual.
What Can You Do Right Now?
- Move the majority of your communications to Signal, Session, or something even more private running over data or Wi-Fi. Treat any Mexican number as a high-visibility surveillance channel used only when unavoidable.
- For mobile data, use a foreign data eSIM as a temporary or secondary connection while accepting its cost and data-only limitations.
- For a Mexican-looking number that is not a CRT-linked prepaid line, evaluate MoreMins (app-based, but Mexican numbers cannot receive SMS | use a USA or Canadian number for SMS) or PrivacyNumber (web-panel only; pin a permanent browser shortcut to the home screen and open the control panel for calls and SMS).
- Acquire a supported Pixel device and install GrapheneOS using the official installer. Configure it as a hardened privacy device before you place any registered line in it.
- Retain only the minimum number of CURP-linked lines necessary for banking and government portals. Prefer app-based authenticators wherever services allow them.
- Support the ongoing amparo litigation and the digital-rights organisations documenting the programme’s scope. Legal challenge remains one of the few systemic counters available.
Hardened devices (both phones running GrapheneOS and computers running audited, privacy-respecting operating systems) are becoming an indispensable hardware requirement for anyone who intends to maintain control over the four Keys to Freedom: the mental capacity to think without algorithmic capture, the digital capacity to control devices and communications, the economic capacity to move value without programmable interference, and the strategic capacity to read systemic shifts clearly enough to protect options.
A registered number on a stock device hands most of those keys to the systems that issued the number.
A registered number on a fully encrypted, hardened device keeps the majority of usable surveillance outside the practical reach of the authorities that demanded the registration in the first place.
The only way back to freedom is through the fire. The fire, in this case, is the deliberate choice to stop treating the phone in your pocket as a passive endpoint and to start treating it as a hardened instrument under your own control.
Stay sovereign and stay informed
