Using an old personal phone is probably a bad idea. The chance of relevant parties having a list of phone-identifier/owner seems high, and it’s hard to guarantee that the phone won’t leak its identifiers. The suggestion of buying one with cash on eBay or so sounds reasonable, but you’d have to be careful the device is not broken or has malware on it. And that the email you use to make contact is not easily traceable to you.