VPNs and virtual numbers: why the people attacking you are not really invisible

People who suffer online harassment, a shaming campaign or a hate campaign often hear the same sentence: “They will never find me anyway”. Messages from foreign numbers, calls at all hours, accounts that disappear and come back. Sometimes the attackers themselves boast about it: “I use a VPN”.

This article explains what these technologies really hide, how you can protect yourself and why a report can get to places you cannot reach on your own.

Why they seem untouchable

Seeming out of reach is part of the attack: if you think reporting is pointless, the person attacking you has already gained something.

But “hidden from you” does not mean “hidden from everyone”. Behind every VPN, virtual number or account there is a company that holds data. And many companies hand it over when a judicial authority asks for it.

What a VPN hides, and what it does not

A VPN (virtual private network) is a service that routes your connection through an intermediate server. Websites and apps see the IP address of that server, not the real one. The IP address is the number that identifies an internet connection at a given moment.

But a VPN does not erase traces. It moves them:

The VPN provider sees the real IP address of the person connecting, and can keep it if its rules do not rule that out.
Payment by card or account leaves data about who pays.
Accounts remain accounts. Platforms keep data such as phone number, email and the IP addresses of logins. A single login made without the VPN is enough for the real address to remain in their records.
The phone or computer stay the same, and can be seized.

The EFF, a digital rights organisation, puts it bluntly: “a VPN is not an anonymity tool”.

There are also providers that truly keep no connection logs: asking them leads nowhere. That is why investigations do not stop at the VPN and look for the other traces.

An Italian example. In early 2024 the Polizia Postale in Rome announced the arrest of a man accused of stalking a former colleague for two months. He used a Romanian VPN, wrote from an anonymous foreign email address and paid through foreign channels: at first he could not be identified. The breakthrough came when the woman reported a new episode, an expensive gift delivered to her home. The proceedings were then at the investigation stage and the man is to be considered innocent until a final conviction. But the case shows that the VPN was not enough.

Virtual numbers and calls from abroad

VoIP calls travel over the internet instead of the traditional telephone network. A virtual number is a number rented from an online service, which works from an app and not from a SIM card. You can have a British or American number while living in Italy: the country code says nothing about where the caller is.

Even the number you see on the screen can be faked: this is called spoofing. Europol, the European Union’s police agency, explains that it is often done with VoIP services and that it is “easy to do but hard to investigate”.

Hard does not mean impossible, though. The companies that provide numbers and calls over the internet usually hold registration, payment and app connection data, and they answer to the authorities:

Twilio, a large internet calling and SMS platform used by many companies, received 4,842 requests from authorities around the world in 2025 and provided data in 4,285 cases.
TextNow, a virtual number service, accepts direct requests only from the United States and Canada. The others go through an international letter rogatory, that is, a request for help between States: it is slower, but it is a route.
In November 2022 an international operation led by the United Kingdom, with Europol’s support, shut down a website that sold calls with a faked number “anonymously”: 142 arrests among users and administrators.

For SIM cards, in Italy the operator must identify the customer with an ID document before activating one, including for eSIMs, number portability and SIM replacement. In Switzerland a similar obligation applies. But a SIM can be registered to someone using other people’s documents, and that is a crime: the number calling you does not tell you for certain who is behind it. Leave it to investigators to verify.

Companies answer to the courts too

Some documented cases:

2017, United States. A man stalked his former roommate online while hiding behind a VPN. The provider’s records, PureVPN, showed that the same customer connected from his home and from his office. In 2018 he was sentenced to more than 17 years for a long series of crimes.
Telegram, since 2024. On a valid order from the judicial authority it can hand over the IP address and phone number of people suspected of crimes. According to the data from its transparency bot, collected by an independent archive, fulfilled Italian requests went from 6 (January-September 2024) to 407 in the second quarter of 2026 alone.
Meta (Facebook, Instagram, Messenger). It can give the authorities email, credit card data and, where available, the IP addresses of recent logins. For Messenger’s encrypted chats it cannot give the content, but it provides the logs of messages and calls and the IP addresses. On request it keeps the data for 90 days, pending the formal order.
Payments. PayPal also states that it discloses data to courts and law enforcement when the law requires it.
“Criminal” VPNs shut down by international operations backed by Europol: Safe-Inet in December 2020, VPNLab in January 2022, First VPN in May 2026. In the last case investigators obtained the list of users and warned them that they had been identified. The investigation had started in December 2021 and the public prosecutor’s office and cantonal police of Zurich also took part. In 2022 the Hanover police commented that services that help illegal activities and do not answer the authorities’ requests “are not bulletproof”.

What changes in Europe and Switzerland

European Union. From 18 August 2026 the European regulation on electronic evidence (e-Evidence) applies. An Italian magistrate can order a company that offers services in the EU, even if it is based elsewhere, to hand over data directly: within 10 days, within 8 hours if there is an imminent danger to a person’s life or safety. The data needed to identify who is behind an account (subscriber data, IP addresses with date and time) can be requested for any crime. The regulation applies only in criminal proceedings and only to data that the company still holds when the order arrives.

Italy. Operators keep telephone traffic data for 24 months, internet traffic data for 12 months and data on unanswered calls for only 30 days. The law expressly provides that the judge authorises their acquisition also for serious threats and harassment made by phone.

Switzerland. It is not part of the EU, so Swiss authorities cannot use e-Evidence. As Proton, a Swiss email service known for privacy, explains, a Swiss company cannot hand over data directly to a foreign police force: the request goes through the Swiss authorities with international judicial assistance. Italy and Switzerland have ratified the Council of Europe’s Budapest Convention on cybercrime, created to make countries cooperate against these crimes. In April 2025 the Federal Council asked for simpler rules on electronic evidence and closer cooperation with the EU to be assessed.

It is slower, but it works. In 2021 Proton Mail received a binding order from the Swiss authorities, arising from a French investigation, and could not oppose it: according to the press it handed over the IP address of the account. The emails, being encrypted, remained unreadable. In 2025 Proton Mail carried out 8,313 orders from the Swiss authorities.

How to protect yourself

Do not answer unknown or foreign numbers and do not call them back.
On WhatsApp turn on “Silence unknown callers” (Settings › Privacy › Calls). The calls do not ring but stay in the list: you need them as evidence.
On Telegram, in Settings › Privacy and Security, choose who sees your number, who can find you by your number and who can call you. In the call settings choose the most restrictive option for “peer-to-peer”: that way calls go through Telegram’s servers and the other person does not see your IP address.
Save everything before blocking: screenshots of the call list with number, date and time, messages, links. Then report and block. Here we explain how to preserve evidence on Telegram.
Do not open the links they send you. Every website sees the IP address of its visitors, and a link prepared on purpose can be used precisely to collect it.
Protect your accounts with two-step verification through an authenticator app, not through SMS.
Protect your SIM. Ask your operator what protections it offers for operations on your line, such as an extra PIN. If your phone suddenly loses signal, call the operator at once: someone may have asked for a new SIM in your name (SIM swap).
Do not try to unmask them on your own. You risk accusing an innocent person, gathering evidence that is worthless and getting yourself into trouble. We talk about it here.

Why reporting really matters

Companies hand data over to the authorities, not to victims. Without a report, nobody can ask for it.

Time matters. In Italy, data on unanswered calls is kept for only 30 days, and the European order works only on data that still exists. Report quickly, even against unknown persons, and report every new episode: in the Rome case it was decisive.

What helps investigators:

the exact numbers, with date, time and time zone of every call or message;
for Telegram, the numeric ID of the account, which does not change like the name or username;
links, usernames and complete screenshots;
the list of all accounts and numbers, even if you think they belong to the same person;
other victims: more reports with the same pattern make the case more serious and easier to link.

Let’s be honest: identification is not guaranteed. It can take months or years, and sometimes a name is never reached. But the report stays on file, is linked to later ones and, if new elements emerge, a closed investigation can be reopened.

You do not have to face this alone. Tell us your case or find who can help you.