Your phone shares two ID numbers that rarely change, and fake cell towers and other tricks can use them to track you. Here is how it works.
In April 2026, Canadian authorities arrested three men for running a fake cell tower that sent phishing texts to nearby phones. The case points to a bigger issue. Your phone hands out ID numbers that almost never change, and fake towers are built to collect them.
The IMSI is tied to your SIM card. The IMEI is tied to your physical phone. Both typically never change. Think of the IMSI as a license plate that follows your SIM, and the IMEI as a VIN that stays with the device. The network does not verify the IMEI, so it names a device without proving anything.
A fake tower tricks phones into connecting to the strongest signal and sharing information before anything is verified. In 4G, a phone sends its IMSI in plain, readable form to a tower that has not proven who it is. 5G encrypts this number, but 5G coverage is not everywhere, so an attacker can push a phone down to 4G or older.
A basic fake tower on 4G or 5G gets the plate but not the VIN. A phone sends its IMEI only after it has authenticated with the network.
An idle phone sleeps to save battery and wakes at set moments to check for calls and texts. In 4G, that timing is worked out from the IMSI with a public formula. Since the IMSI never changes, neither does the timing.
A 2019 study showed how to use this. An attacker who knows your phone number triggers silent calls, which hang up before your phone rings, and watches with a nearby radio receiver. After about eight tries on average, they can confirm you are in the area. It worked against all the US carriers tested.
The study went further. Using a fake tower, researchers could link a phone number to its IMSI. Some carriers broadcast the raw IMSI when normal messages to a phone fail, and an attacker can trigger that. This was confirmed against one major US carrier.
With your IMSI, an attacker can track your location or intercept calls and texts through attacks on carrier signaling. On a typical carrier, a stolen IMSI stays useful for years. If your carrier itself is compromised, someone could also track you by IMEI.
The article is published alongside a promotion for Cape, a US carrier that changes your IMSI every 24 hours or on demand. The numbers come from a shared pool reassigned among customers. A stolen IMSI goes stale within a day, and the 4G timing pattern no longer matches. Attackers can still ask for your current IMSI in real time. The article does not say whether other carriers offer similar rotation.
Your SIM and phone IDs rarely change, so a stolen one can be used for years unless your carrier rotates it.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammersKMBC 9 News has launched Scam School, a series on spotting the warning signs of scam texts and calls so you can protect your money and your family.
Read more: A local TV series shows the warning signs of phone and text scams
