In April 2026, BleepingComputer reported that Canadian authorities arrested three men accused of operating an “SMS Blaster,” a device that impersonated a cell phone tower and sent phishing messages to nearby phones. The incident highlights how fake cell towers and IMSI catchers can trick phones into connecting to the strongest signal and revealing identifying information before the network has authenticated the connection.
An IMSI catcher is a fake base station commonly associated with surveillance. One of the main identifiers it can collect is the IMSI linked to a phone’s SIM card, but a phone communicates more than just that identifier.
What information does your phone broadcast?
Phones contain multiple radios that connect to different types of wireless signals and share different information.
Wi-Fi and Bluetooth radios use hardware addresses. Modern phones randomize or rotate these addresses to make tracking more difficult.
Cellular radios expose two identifiers that typically remain unchanged: the IMSI associated with the SIM card and the IMEI associated with the physical device.
IMSI vs. IMEI
IMSI, or International Mobile Subscriber Identity, is a unique number assigned by a mobile carrier when a customer signs up for service. It is stored on the SIM card and used by the cellular network to locate and authenticate subscribers. In most cases, an IMSI does not change.
IMEI, or International Mobile Equipment Identity, is a unique number associated with a physical phone. Unlike the IMSI, the IMEI is not authenticated by the network. It identifies the device without proving the device’s identity.
The protection applied to each identifier depends on the cellular technology in use. These standards come from 3GPP, the industry group that develops mobile-network specifications. Newer generations provide stronger identifier protections, but phones that fall back to older network technologies can become vulnerable to fake towers.
| Network | IMSI | IMEI |
|---|---|---|
| 2G/3G | Sent in plain text without encryption. | Sent in clear text and may be sent without a secure channel. |
| 4G (LTE) | Sent in clear text when the phone first connects, then replaced with a temporary ID called a GUTI to reduce IMSI exposure. | Sent only after mutual authentication. |
| 5G standalone | Encrypted as a Subscription Concealed Identifier (SUCI). | Sent only after mutual authentication. |
How an IMSI can be exposed
-
IMSI catcher or fake base station: In 4G, a phone can send its IMSI in clear text to a tower that has not proved its identity. This is the basic IMSI-catcher attack. 5G’s SUCI encryption is designed to address this weakness, but 5G coverage is not universal, and IMSI catchers can attempt to downgrade devices to 4G or older technologies.
-
Paging attack: An idle phone saves battery by sleeping and waking at scheduled intervals, known as paging opportunities, to check for incoming calls, text messages, or notifications. In 4G, the paging slot is calculated from the IMSI using a publicly documented formula. The IMSI remains unchanged, and so does the slot. In 5G, the slot is calculated from a temporary identifier instead.
In 2019 research, researchers showed how this paging behavior could be exploited.
An attacker who knows a person’s phone number could trigger “silent calls”—calls that end before the phone rings—as well as text messages or app notifications. Nearby wireless receivers could then monitor the paging slots associated with that activity.
After about eight attempts on average, the resulting pattern can confirm that the phone is in the area, without requiring a fake tower. The source article states that the technique worked for every US airline tested.
A paging attack can also enable more serious attacks. An attacker may use a fake tower to connect a phone number directly to an IMSI. Some carriers fall back to broadcasting the raw IMSI in paging messages when normal paging to the phone’s temporary identifier fails. An attacker who knows the paging slot can deliberately trigger that fallback.
A fake tower can block the network’s paging messages and force the carrier to send the IMSI over the air in response to a single silent call. The attacker can then capture the IMSI. Researchers tested this technique against one major U.S. carrier.
Once an attacker obtains an IMSI, it can be used to track a phone’s location or intercept phone calls and text messages through signaling attacks described in a previous article.
What happens to the IMEI?
An IMSI catcher can be compared to a license-plate reader. The IMSI is the plate associated with the SIM card, while the IMEI is the vehicle identification number attached to the physical phone. On 4G and 5G networks, a phone sends its IMEI only after authenticating with the network. As a result, a basic fake tower may obtain the IMSI but not the IMEI.
An attacker typically must first downgrade the phone to an older network technology or use authentication data previously obtained through an SS7 or Diameter attack. That authentication data begins with the IMSI. The IMSI—not the IMEI—is used to route calls and determine a phone’s location through signaling.
However, if a mobile carrier itself is compromised, anyone with access to its systems could potentially track a subscriber by the device’s IMEI.
Why IMSI rotation can help
Cape is a privacy-first U.S. carrier that offers unlimited talk, text, and 4G/5G data. The company says it collects the minimum information needed to provide service, deletes call and text metadata after 24 hours, rotates network identifiers to reduce tracking, and defends against SIM- and network-based attacks.
Cape’s identifier rotation changes IMSIs every 24 hours or on demand. The service rotates seven IMSIs per week from a shared pool that is continually reallocated among customers, meaning each IMSI contains a complex history associated with many people’s activity.
According to Cape, this approach provides several benefits:
- A captured IMSI becomes stale. Signaling attacks often begin by collecting a target’s IMSI, which can remain useful for years with a typical carrier. A rotating IMSI no longer points to the same customer after a day. Cape says the rotation works alongside its signaling protection, although an attacker may still request the current IMSI in real time.
- The paging fingerprint changes. On 4G, a new IMSI produces a new paging slot, so a previously constructed activity pattern no longer matches.
- An IMSI catcher loses continuity. Although a catcher may retrieve the current IMSI, it cannot automatically connect it to the previous day’s IMSI. This makes it more difficult to build a long-term history or confirm that a phone seen previously is nearby. Cape also offers a GrapheneOS LTE-only mode that blocks downgrades.
For most people, the tracking risk that matters most is long-term tracking based on stable identifiers. Rotating those identifiers can disrupt that continuity.
Switch to a carrier that rotates your ID. Click here for more information about Cape →
Sponsored and written by Cape.
Source: www.bleepingcomputer.com