Hackers can track your phone and read your texts without touching it

Attackers can track a phone, redirect its calls and texts, and pose as its owner without touching the device. The attacks run inside carrier networks, so no malware or phishing link is needed. Nothing shows up on your phone. The details come from a BleepingComputer piece written by Cape, a mobile carrier that sells protection against these attacks.

How the attacks work

Every call, text and data session needs your carrier to confirm you are a customer and route your traffic. Carriers do this with background messages called signaling. Two systems handle most of it: SS7, from the 1970s and used in 2G and 3G, and Diameter, its successor used in 4G and most 5G.

Both were built when only a few large operators could connect, so they assume a message that claims to come from a real operator is real. SS7 has essentially no way to check who is asking. Diameter can do better on paper, but operators do not always turn on basic protections such as encryption.

What an attacker can do

An attacker needs access to the global signaling backbone, either by leasing it commercially or through a compromised operator. From there, the carrier treats their messages as trustworthy.

• Locate you in real time, in some cases down to the coordinates your phone reports.
• Claim you have roamed to another network, so your calls and texts go to them.
• Place calls or send texts as you, or cut off your service with a false roaming claim.
• Send misconfigured messages that can overwhelm a provider's systems.

Redirected texts matter most for money. Paired with a stolen username and password, they hand over the one-time code your bank sends by SMS.

Where it has happened

Iranian-linked actors reportedly used outdated network technology to locate US personnel's phones in the Middle East during the Iran war. Criminals have reportedly intercepted bank passcodes to drain accounts. Citizen Lab exposed two long-running commercial surveillance campaigns, with thousands of attacks on targets in dozens of countries. Congressman Ted Lieu's phone was hacked on live TV, and YouTuber Veritasium hijacked a tech influencer's calls and texts using only his number.

Why carrier defenses fall short

Carrier firewalls block messages sent from or to the wrong place. They also check whether you could have traveled from your last known spot to the one now claimed. The weakness is that location data is often hours old. Cape's 2025 research measured some updates arriving only every two to ten hours.

Citizen Lab saw attackers exploit this. One actor, called STA1, rotated through eleven operator identities in nine countries to look like normal roaming. It also switched between SS7 and Diameter, which most carriers guard with separate firewalls and little coordination.

What to do

Move banking and email logins away from text message codes where you can. An authenticator app or a passkey does not rely on your phone number, so a redirected text gets an attacker nothing. Cape says it does not support SS7 at all, but the article is cut off before it finishes describing its protections, and those claims are the company's own.