IMSI vs IMEI: What Your Phone Broadcasts and Who Can Read It

In April 2026, Canadian authorities arrested three men for operating an SMS blaster, a device pretending to be a cell tower to send phishing texts. This technology is closely related to the IMSI catcher, a surveillance device that tricks phones into connecting before authentication.

• Phone identifiers: IMSI (tied to the SIM card) and IMEI (tied to the physical device).
• Security risks: Fake base stations, paging attacks, and plaintext identifier exposure.
• Defense mechanisms: 5G encryption standards and identifier rotation features from privacy-focused carriers.

The Difference Between IMSI and IMEI Vulnerabilities

Your phone features several radios connecting to different signals. While modern phones randomize Wi-Fi and Bluetooth hardware addresses to reduce tracking, the cellular radio reveals two identifiers that typically remain unchanged: the IMSI and the IMEI.

The IMEI is a unique number tied to the physical phone and is not authenticated by the network during early connection. The IMSI is tied to your SIM card and is often sent in plaintext over 4G networks to unverified towers. While 5G introduces SUCI encryption to close this gap, incomplete coverage allows attackers to downgrade devices to older network generations.

Paging Attacks and Identifier Interception

An idle phone saves battery by waking up at specific paging occasions to check for incoming calls and texts. In 4G networks, this slot is calculated using the IMSI via a public formula. An attacker knowing a phone number can trigger silent calls and monitor radio receivers to track activity.

After a few attempts, the pattern confirms the user's location without needing a fake tower. Attackers can also use a fake base station to block network pages and force the carrier to broadcast the raw IMSI over the air. Once captured, the IMSI enables location tracking and call interception.

Identifier Rotation as a Defense Against Tracking

Modern privacy-first approaches eliminate long-term stable identifiers. For instance, mobile carriers can implement identifier rotation, changing the IMSI every 24 hours or on demand through a shared customer pool. This renders harvested tracking data stale quickly.

Because the identifier shifts regularly, historical tracking patterns break, and paging fingerprints constantly move. Combined with secure operating system features like LTE-only mode, identifier rotation effectively blocks network downgrade attacks and protects subscriber privacy.