If I understand correctly you need atleast one sms to know the credentials to the web portal. that's probably enough to get caught if someone finds the device.

If you can get an unidentifiable SIM for the tracker, you can also get one + a burner phone for yourself. And if someone is stupid enough to not do that or to turn on either device in an identifiable location, they're beyond help.