The International Mobile Equipment Identity (IMEI)[1] is a numeric identifier, usually unique,[2][3] for 3GPP and iDENmobile phones, as well as some satellite phones. It is usually found printed inside the battery compartment of the phone but can also be displayed on-screen on most phones by entering the MMI Supplementary Service code*#06# on the dialpad, or alongside other system information in the settings menu on smartphone operating systems.
GSM networks use the IMEI number to identify valid devices, and can stop a stolen phone from accessing the network. For example, if a mobile phone is stolen, the owner can have their network provider use the IMEI number to blocklist the phone. This renders the phone useless on that network and sometimes other networks, even if the thief changes the phone's SIM card.
Devices without a SIM card slot or eSIM capability usually do not have an IMEI, except for certain early SprintLTE devices such as the SamsungGalaxy Nexus and S III which emulated a SIM-free CDMA activation experience and lacked roaming capabilities in 3GPP-only countries.[4] However, the IMEI only identifies the device and has no particular relationship to the subscriber. The phone identifies the subscriber by transmitting the International mobile subscriber identity (IMSI) number, which is stored on a SIM card that can, in theory, be transferred to any handset. However, the network's ability to know a subscriber's current, individual device enables many network and security features.[citation needed]
Dual SIM enabled phones will normally have two IMEI numbers, except for devices such as the Pixel 3 (which has an eSIM and one physical SIM) which only allow one SIM card to be active at once.
IMEI and the law
Many countries have acknowledged the use of the IMEI in reducing the effect of mobile phone thefts. For example, in the United Kingdom, under the Mobile Telephones (Re-programming) Act, changing the IMEI of a phone, or possessing equipment that can change it, is considered an offence under some circumstances.[5][6] A bill was introduced in the United States by Senator Chuck Schumer in 2012 that would have made the changing of an IMEI illegal, but the bill was not enacted.[7]
IMEI blocking is not the only way to fight phone theft. Instead, mobile operators are encouraged to take measures such as immediate suspension of service and replacement of SIM cards in case of loss or theft.[8]
The existence of a formally allocated IMEI number range for a GSM terminal does not mean that the terminal is approved or complies with regulatory requirements. The linkage between regulatory approval and IMEI allocation was removed in April 2000, with the introduction of the European R&TTE Directive.[9] Since that date, IMEIs have been allocated by BABT (or one of several other regional administrators acting on behalf of the GSM Association) to legitimate GSM terminal manufacturers without the need to provide evidence of approval.
Blocklists of stolen devices
When someone has their mobile equipment stolen or lost, they can ask their service provider to block the phone from their network, and the operator may do so, especially if required by law. If the local operator maintains an Equipment Identity Register (EIR), it adds the device IMEI to it. Optionally, it also adds the IMEI to shared registries, such as the Central Equipment Identity Register (CEIR), which blocklists the device with other operators that use the CEIR. This blocklisting makes the device unusable on any operator that uses the CEIR, which makes mobile equipment theft pointless, except for parts.
To make blocklisting effective, the IMEI number is supposed to be difficult to change. However, a phone's IMEI may be easy to change with special tools.[10][bettersourceneeded] In addition, IMEI is an un-authenticated mobile identifier (as opposed to IMSI, which is routinely authenticated by home and serving mobile networks.) Using a spoofed IMEI can thwart some efforts to track handsets, or target handsets for lawful intercept.[citation needed]
Australia was the first nation to implement IMEI blocking across all GSM networks, in 2003.[11] In Australia the Electronic Information Exchange (EIE) Administration Node provides a blocked IMEI lookup service for Australian customers.[12]
In the UK, a voluntary charter operated by the mobile networks ensures that any operator's blocklisting of a handset is communicated to the CEIR and subsequently to all other networks. This ensures that the handset is quickly unusable for calls, at most within 48 hours.
Some UK Police forces, including the Metropolitan Police Service, actively check IMEI numbers of phones found involved in crime.
In New Zealand, the NZ Telecommunications Forum Inc[13] provides a blocked IMEI lookup service for New Zealand consumers. The service allows up to three lookups per day[14] and checks against a database that is updated daily by the three major mobile network operators. A blocked IMEI cannot be connected to any of these three operators.
In Latvia the SIA "Datorikas institūts DIVI"[15] provides a blocked IMEI lookup service for checks against a database that is updated by all major mobile network operators in Latvia.
In some countries, such blocklisting is not customary. In 2012, major network companies in the United States, under government pressure, committed to introducing a blocklisting service, but it's not clear whether it will interoperate with the CEIR.[16][17] GSM carriers AT&T and T-Mobile began blocking newly reported IMEIs in November 2012.[18] Thefts reported prior to November 2012 were not added to the database. The CTIA refers users to websites at www.stolenphonechecker.org[19] and the GSMA[19] where consumers can check whether a smartphone has been reported as lost or stolen to its member carriers. The relationship between the former and any national or international IMEI blocklists is unclear.[19]
It is unclear whether local barring of IMEI has any positive effect, as it may result in international smuggling of stolen phones.[20]
Limitations
IMEIs can sometimes be removed from a blocklist, depending on local arrangements. This would typically include quoting a password chosen at the time of blocklisting.[citation needed]
Law enforcement and intelligence use
Law enforcement and intelligence services can use an IMEI number as input for tracking devices that are able to locate a cell phone with an accuracy of a few meters. Saudi Arabian government agencies have reportedly used IMEI numbers retrieved from cell phone packaging to locate and detain women who fled Saudi Arabia's patriarchal society in other countries.[21]
An IMEI number retrieved from the remnants of a Nokia 5110 was used to trace and identify the perpetrators behind the 2002 Bali bombings.[22]
Allowlists
Some countries use allowlists instead of blocklists for IMEI numbers, so that any mobile phone needs to be legally registered in the country in order to be able to access mobile networks of the country, with possible exceptions for international roaming and a grace period for registering.[23] These include Chile,[24] Turkey,[25] Azerbaijan,[26] Colombia,[27] and Nepal.[28] Other countries that have adopted some form of mandatory IMEI registration include India, Pakistan, Indonesia, Cambodia, Thailand, Iran, Nigeria, Ecuador, Ukraine, Lebanon,[29] and Kenya.[30]
Prior to their merger with T-Mobile, Sprint in the United States used an allowlist of devices where a user had to register their IMEI and SIM card before a device can be used, despite no US law mandating it.[31] If a user changed their device, they had to register their new IMEI and SIM card. This isn't the case with other CDMA carriers like Verizon which only used allowlists for 3G (which was a requirement for CDMA) and T-Mobile does not use an allowlist but instead a blocklist, including for former Sprint customers.
AT&T[32] and Telus[33] also use an allowlist for VoLTE access, but does not require IMEI registration by customers. Instead, phone manufacturers are required to register their devices into AT&T's or Telus' databases, and customers are able to freely swap SIM cards or eSIMs into any allowlisted device. This has the problem that imported phones and some non-imported phones such as older OnePlus models or select CDMA-capable LTE devices (including models sold on Verizon or Sprint) will not work for voice calls even if they have the LTE/5G bands for AT&T and Telus and support VoLTE on competitors or via VoLTE roaming.
Structure of the IMEI and IMEISV (IMEI software version)
The IMEI (15 decimal digits: 14 digits plus a check digit) or IMEISV (16 decimal digits: 14 digits plus two software version digits) includes information on the origin, model, and serial number of the device. The structure of the IMEI/SV is specified in 3GPP TS 23.003. The model and origin comprise the initial 8-digit portion of the IMEI/SV, known as the Type Allocation Code (TAC). The remainder of the IMEI is manufacturer-defined, with a Luhn check digit at the end. For the IMEI format prior to 2003, the GSMA guideline was to have this Check Digit always transmitted to the network as zero. This guideline seems to have disappeared for the format valid from 2003 onwards.[34]
As of 2004[update], the format of the IMEI is AA-BBBBBB-CCCCCC-D, although it may not always be displayed this way. The IMEISV does not have the Luhn check digit but instead has two digits for the Software Version Number (SVN), making the format AA-BBBBBB-CCCCCC-EE
AA
-
BB
BB
BB
-
CC
CC
CC
D or EE
Old IMEI
TAC
FAC
Serial number
D = Check Digit (CD) (Optional)
New IMEI
TAC
Old IMEISV
TAC
FAC
EE = Software Version Number (SVN)
New IMEISV
TAC
Prior to 2002, the TAC was six digits and followed by a two-digit Final Assembly Code (FAC), which was a manufacturer-specific code indicating the location of the device's construction. From January 1, 2003 until April 1, 2004, the FAC for all phones was 00. After April 1, 2004, the Final Assembly Code ceased to exist and the Type Allocation Code increased to eight digits in length.
In any of the above cases, the first two digits of the TAC are the Reporting Body Identifier, which identifies the GSMA-approved group that allocated the TAC. The RBI numbers are allocated by the Global Decimal Administrator. IMEI numbers being decimal helps distinguish them from an MEID, which is hexadecimal and always has 0xA0 or larger as the first two hexadecimal digits.
For example, the old style IMEI code 35-209900-176148-1 or IMEISV code 35-209900-176148-23 tells us the following:
TAC: 35-2099 - issued by the BABT (code 35) with the allocation number 2099 FAC: 00 - indicating the phone was made during the transition period when FACs were being removed. SNR: 176148 - uniquely identifying a unit of this model CD: 1 so it is a GSM Phase 2 or higher SVN: 23 - The "software version number" identifying the revision of the software installed on the phone. 99 is reserved.
By contrast, the new style IMEI code 49-015420-323751-8 has an 8-digit TAC of 49-015420.
The CDMA Mobile Equipment Identifier uses the same basic format as the IMEI but gives more flexibility in allocation sizes and usage.
The Check Digit shall be calculated according to Luhn formula (ISO/IEC 7812). (See GSM 02.16 / 3GPP 22.016). The Check Digit is a function of all other digits in the IMEI. The Software Version Number (SVN) of a mobile is not included in the calculation.
The purpose of the Check Digit is to help guard against the possibility of incorrect entries to the CEIR and EIR equipment.
The presentation of the Check Digit both electronically and in printed form on the label and packaging is very important. Logistics (using bar-code reader) and EIR/CEIR administration cannot use the Check Digit unless it is printed outside of the packaging, and on the ME IMEI/Type Accreditation label.
The check digit is not transmitted over the radio interface, nor is it stored in the EIR database at any point. Therefore, all references to the last three or six digits of an IMEI refer to the actual IMEI number, to which the check digit does not belong.
The check digit is validated in three steps:
Starting from the right, double every other digit (e.g., 7 → 14).
Sum the digits (e.g., 14 → 1 + 4).
Check if the sum is divisible by 10.
Conversely, one can calculate the IMEI by choosing the check digit that would give a sum divisible by 10. For the example IMEI 49015420323751?,
To make the sum divisible by 10, we set x = 8, so the complete IMEI becomes 490154203237518.
Usage on satellite phone networks
The Broadband Global Area Network (BGAN), Iridium and Thurayasatellite phone networks all use IMEI numbers on their transceiver units as well as SIM cards in much the same way as GSM phones do. The Iridium 9601 modem relies solely on its IMEI number for identification and uses no SIM card; however, Iridium is a proprietary network and the device is incompatible with terrestrial GSM networks.
The Global System for Mobile Communications (GSM) is a standard developed by the European Telecommunications Standards Institute (ETSI) to describe the protocols for second-generation (2G) digital cellular networks used by mobile devices such as mobile phones and tablets. GSM is also a trade mark owned by the GSM Association. "GSM" may also refer to the voice codec initially used in GSM.
General Packet Radio Service (GPRS), also called 2.5G, is a mobile data standard on the 2G cellular communication network's global system for mobile communications (GSM). Networks and mobile devices with GPRS started to roll out around the year 2001. At the time of introduction it offered for the first time seamless mobile data transmission using packet data for an "always-on" connection, providing improved Internet access for web, email, WAP services, and Multimedia Messaging Service (MMS).
The Universal Mobile Telecommunications System (UMTS) is a 3G mobile cellular system for networks based on the GSM standard. Developed and maintained by the 3GPP, UMTS is a component of the International Telecommunication Union IMT-2000 standard set and compares with the CDMA2000 standard set for networks based on the competing cdmaOne technology. UMTS uses wideband code-division multiple access (W-CDMA) radio access technology to offer greater spectral efficiency and bandwidth to mobile network operators.
The international mobile subscriber identity is a number that uniquely identifies every user of a cellular network. It is stored as a 64-bit field and is sent by the mobile device to the network. It is also used for acquiring other details of the mobile in the home location register (HLR) or as locally copied in the visitor location register. To prevent eavesdroppers from identifying and tracking the subscriber on the radio interface, the IMSI is sent as rarely as possible and a randomly-generated TMSI is sent instead.
A SIMcard is an integrated circuit (IC) intended to securely store an international mobile subscriber identity (IMSI) number and its related key, which are used to identify and authenticate subscribers on mobile telephone devices. SIMs are also able to store address book contacts information, and may be protected using a PIN code to prevent unauthorized use.
A SIM lock, simlock, network lock, carrier lock or (master) subsidy lock is a technical restriction built into GSM and CDMA mobile phones by mobile phone manufacturers for use by service providers to restrict the use of these phones to specific countries and/or networks. This is in contrast to a phone that does not impose any SIM restrictions.
Network switching subsystem (NSS) is the component of a GSM system that carries out call out and mobility management functions for mobile phones roaming on the network of base stations. It is owned and deployed by mobile phone operators and allows mobile devices to communicate with each other and telephones in the wider public switched telephone network (PSTN). The architecture contains specific features and functions which are needed because the phones are not fixed in one location.
Unstructured Supplementary Service Data (USSD), sometimes referred to as "quick codes" or "feature codes", is a communications protocol used by GSM cellular telephones to communicate with the mobile network operator's computers. USSD can be used for WAP browsing, prepaid callback service, mobile-money services, location-based content services, menu-based information services, and as part of configuring the phone on the network. The service does not require a messaging app, and does not incur charges.
MSISDN is a number uniquely identifying a subscription in a Global System for Mobile communications or a Universal Mobile Telecommunications System mobile network. It is the mapping of the telephone number to the subscriber identity module in a mobile or cellular phone. This abbreviation has several interpretations, the most common one being "Mobile Station International Subscriber Directory Number".
The Type Allocation Code (TAC) is the initial eight-digit portion of the 15-digit IMEI and 16-digit IMEISV codes used to uniquely identify wireless devices.
GSM frequency bands or frequency ranges are the cellular frequencies designated by the ITU for the operation of GSM mobile phones and other mobile devices.
The universal integrated circuit card (UICC) is the physical smart card used in mobile terminals in 2G (GSM), 3G (UMTS), 4G (LTE), and 5G networks. The UICC ensures the integrity and security of all kinds of personal data, and it typically holds a few hundred kilobytes.
An international mobile subscriber identity-catcher, or IMSI-catcher, is a telephone eavesdropping device used for intercepting mobile phone traffic and tracking location data of mobile phone users. Essentially a "fake" mobile tower acting between the target mobile phone and the service provider's real towers, it is considered a man-in-the-middle (MITM) attack. The 3G wireless standard offers some risk mitigation due to mutual authentication required from both the handset and the network. However, sophisticated attacks may be able to downgrade 3G and LTE to non-LTE network services which do not require mutual authentication.
The Reporting Body Identifier is the first two digits of a Global System for Mobile Communications (GSM) Type Allocation Code, and indicates the GSMA-approved organization that registered a given mobile device, and allocated the model a unique code.
The StarTAC is a series of mobile phones released by Motorola starting in 1996. It is the successor of the MicroTAC, a semi-clamshell design first launched in 1989. Whereas the MicroTAC's flip folded down from below the keypad, the StarTAC folded up from above the display. The StarTAC was among the first mobile phones to gain widespread consumer adoption; approximately 60 million StarTACs were sold.
A mobile equipment identifier (MEID) is a globally unique number identifying a physical piece of CDMA2000 mobile station equipment. The number format is defined by the 3GPP2 report S.R0048 but in practical terms, it can be seen as an IMEI but with hexadecimal digits.
Phone cloning is the copying of identity from one cellular device to another.
A Central Equipment Identity Register (CEIR) is a database of mobile equipment identifiers. Such an identifier is assigned to each SIM slot of the mobile device. Different kinds o IMEIs could be, White, for devices that are allowed to register in the cellular network; Black, for devices that are prohibited to register in the cellular network; and Grey, for devices in intermediate status.
The GSM Association is a non-profit industry organisation that represents the interests of mobile network operators worldwide. More than 750 mobile operators are full GSMA members and a further 400 companies in the broader mobile ecosystem are associate members.
Voice over Long-Term Evolution is an LTE high-speed wireless communication standard for voice calls and SMS using mobile phones and data terminals. VoLTE has up to three times more voice and data capacity than older 3G UMTS and up to six times more than 2G GSM. It uses less bandwidth because VoLTE's packet headers are smaller than those of unoptimized VoIP/LTE. VoLTE calls are usually charged at the same rate as other calls.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
