IMSI vs. IMEI: What Phones Reveal to Cellular Networks

Phones use several radios to connect to networks, and each can share identifying information. Wi-Fi and Bluetooth hardware addresses are randomized or rotated by modern phones to reduce tracking. Cellular connections expose two identifiers: the IMSI, tied to a SIM card, and the IMEI, tied to the physical device.

How those identifiers are protected depends on the cellular generation. In 4G, a phone can send its IMSI in plaintext to a tower that has not authenticated itself. 5G encrypts it as a Subscription Concealed Identifier (SUCI), but coverage is not universal, and a fake tower can force a phone to fall back to 4G or an older network. The IMEI identifies a device but is sent only after network authentication.

Researchers described a separate 4G paging attack in a 2019 paper. Because a phone’s paging slot is calculated from its IMSI, an attacker who knows its number can trigger silent calls, texts, or app notifications and monitor activity with a nearby receiver. The researchers reported that about eight attempts on average could confirm a phone was in the area, and the method worked against all US carriers they tested.

A fake tower can also exploit paging behavior to capture an IMSI, though researchers validated that approach against one major US carrier. BleepingComputer’s source describes Cape’s Identifier Rotation as changing a customer’s IMSI every 24 hours or on demand, cycling through seven IMSIs a week. The carrier says rotation is layered with signaling protections; the source also notes an attacker can still request a current IMSI in real time.