IMSI vs IMEI: What Your Phone Broadcasts and Who Can Read It

IMSI is now the target of an action by law enforcement.

In April 2026, the outlet reported that Canadian authorities arrested three men for operating an SMS blaster, a device that pretends to be a cell tower to send phishing texts to nearby phones.

It’s a close cousin of the IMSI catcher, the fake-tower device used for surveillance.

Newer generations protect identifiers better, but phones fall back to older ones, which is where fake towers come in.

After about eight tries on average, the pattern confirms you’re in that area, with no fake tower needed.

In 4G, a new IMSI means a new paging slot, so any pattern an attacker builds no longer matches.

Past victims of IMSI are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

The cellular radio reveals two identifiers that typically never change: the IMSI, which is tied to your SIM card, and the IMEI, which is tied to your device.

Unlike the IMSI, the network doesn’t authenticate it, so it names a device without proving anything.

Taking down the infrastructure is real progress, but the skills and the playbook behind it don't disappear with the servers -- treat this as a disruption, not a resolution.

One of the main things a fake tower can collect this way is your IMSI, the identifier tied to your SIM, but it’s far from the only thing your phone gives away.

Transmitted in plaintext and allowed to be sent without secured channel Sent in plaintext the first time a phone connects, then replaced by a temporary ID (a GUTI) to reduce the exposure of the IMSI.

This action was brought by law enforcement, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.

IMSI catchers/fake base stations: In 4G, a phone will send its IMSI in plaintext to a tower that hasn’t proven who it is, which is what an IMSI catcher exploits.

An attacker generally has to downgrade the phone to an older network first, or use authentication data obtained earlier through SS7 or Diameter attacks, which themselves start with an IMSI.

IMSI is now dealing with an active legal process, with the agency involved leading the action.

The Wi-Fi and Bluetooth radios share hardware addresses, which modern phones randomize or rotate to reduce tracking.

Paging attacks: An idle phone saves battery by sleeping and waking only at set moments, called paging occasions, to check for incoming calls, texts, or notifications.

If your environment shows any indicators associated with IMSI, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.

A fake tower hijacks your paging channel to block the network’s pages, and a single silent call then makes the carrier send your IMSI over the air where the attacker captures it.