Two identifiers define how a phone appears to a cellular network: the IMSI and the IMEI. Knowing the difference clarifies what tracking attacks can and cannot do. The source article is sponsored content from Cape, so its mitigation claims are vendor-provided and unverified.
The Two Identifiers
- IMSI is assigned by your carrier and stored on the SIM. The network uses it to identify and authenticate you, and it generally never changes.
- IMEI is tied to the physical handset. The network does not authenticate it, so it identifies a device without proving anything.
Exposure by Network Generation
| Generation | IMSI | IMEI |
|---|---|---|
| 2G/3G | Can be sent in plaintext | Can be sent in plaintext |
| 4G (LTE) | Plaintext on first connection, then replaced by a temporary ID (GUTI) | Sent only after mutual authentication |
| 5G standalone | Encrypted as a SUCI | Sent only after mutual authentication |
Attacks
- IMSI catchers (fake towers): phones send their IMSI before the tower proves its identity. Because 5G coverage is not universal, a fake tower can force a downgrade to 4G or older.
- Paging attacks: in 4G, a phone's paging slot is derived from its IMSI by a public formula. A 2019 study showed that an attacker who knows a phone number can trigger silent calls or messages and watch the slot to confirm the phone is nearby, typically within about eight tries. It worked against all US carriers tested.
- Escalated paging attack: a fake tower blocks normal pages, and some carriers then fall back to broadcasting the raw IMSI. One major US carrier was reported vulnerable, letting an attacker link a phone number to an IMSI.
- Follow-on risks: with an IMSI, an attacker may track location or intercept calls and texts through SS7 or Diameter signaling attacks.
- IMEI exposure: a basic fake tower generally does not capture the IMEI on 4G or 5G. It could be exposed if the carrier itself is compromised.
Mitigations
The sponsor, Cape, describes rotating the IMSI every 24 hours or on demand from a shared pool. A new IMSI changes the paging slot and prevents a catcher from linking it to earlier ones. It also suggests pairing LTE-only mode with GrapheneOS to block downgrades to older networks.
General measures include using 5G standalone where available, disabling 2G, and relying on encrypted messaging so intercepted traffic is useless. Modern phones also randomize Wi-Fi and Bluetooth addresses.