Fake cell towers can pull a permanent subscriber number from nearby phones before any authentication takes place. Phones that drop from 5G to older networks remain exposed, despite stronger protections in newer standards.
Each phone's cellular radio carries two identifiers that generally stay fixed: the IMSI, linked to the SIM card, and the IMEI, linked to the handset itself. Newer network generations guard them better, but phones routinely fall back to older ones, and that is the opening rogue towers use.
The threat has moved beyond the lab. In April 2026, Canadian authorities arrested three men over an "SMS blaster," a device posing as a cell tower to push phishing texts to phones around it. It relies on the same trick as an IMSI catcher: phones latch onto the strongest signal and share data before anything is verified.
A carrier assigns the IMSI when a customer signs up, stores it on the SIM and uses it to find and authenticate that subscriber. The IMEI labels the physical device, but networks do not authenticate it, so it identifies hardware without proving anything.
Locating a phone without a fake tower
On 4G, an IMSI catcher can collect the number unencrypted because the phone never asks the tower to prove its identity. The 5G standard encrypts the identifier as a SUCI, yet patchy 5G coverage lets an attacker push a handset down to 4G or an older network.
Researchers described a subtler method in a 2019 paper. Idle 4G phones wake at set paging slots derived from the IMSI through a public formula, so an attacker who knows a phone number can fire off silent calls, texts or app notifications and watch for activity with a nearby radio receiver.
After roughly eight attempts on average, the pattern reveals whether the target is in the area, no fake tower required. The technique worked against every U.S. carrier the researchers tested; 5G instead derives the slot from a temporary ID.
Limiting the exposure
Add a fake tower and the attack goes further, tying a phone number to its IMSI. Some carriers, when pages to a phone's temporary ID fail, broadcast the raw IMSI instead, and the researchers confirmed this against one major U.S. carrier.
Holding an IMSI lets an attacker track a phone's location or intercept calls and texts through signaling attacks. The IMEI is harder to obtain on 4G and 5G because phones send it only after authenticating, though anyone with access to a compromised carrier could follow a user by it.
Modern phones already randomize or rotate their Wi-Fi and Bluetooth hardware addresses, but the cellular identifiers stay put. Cape, a carrier that markets itself on privacy, says it swaps each customer's IMSI every 24 hours or on demand, cycling seven a week from a shared pool, while acknowledging an attacker can still request the current one in real time.
The company says combining its service with GrapheneOS enables an LTE-only mode that blocks downgrades to older networks.
