In April 2026, Canadian authorities arrested three men for operating an “SMS blaster,” a device that pretends to be a cell tower to send phishing texts to nearby phones.
SMS blasters, IMSI catchers and the basic trick
The SMS blaster arrests grabbed attention because the device is a close cousin of the IMSI catcher — a fake base station used for surveillance. Both exploit the same basic behavior: phones routinely connect to the “strongest” radio signal and share information before either side has authenticated. That early exchange is where identifiers can be harvested.
IMSI: the SIM-linked identifier and how it leaks
The IMSI (International Mobile Subscriber Identity) is a unique number assigned by a carrier and stored on the SIM. It is used by the network to look you up and authenticate you, and for the most part it never changes. In 4G, a phone will send its IMSI in plaintext to a tower that hasn’t proven who it is — the exact opening an IMSI catcher exploits.
Two additional pathways have been demonstrated by researchers. First, paging attacks use the fact that an idle phone wakes on predictable “paging occasions” to check for incoming traffic; in 4G those occasions are calculated from the IMSI using a publicly documented formula. A 2019 paper showed that an attacker who knows your phone number can trigger silent calls, texts or notifications and watch which slot sees activity. After roughly eight tries on average, the pattern confirms the phone is in that area — without needing a fake tower.
Second, that paging fingerprint can be leveraged together with a fake tower. Some carriers fall back to broadcasting the raw IMSI in paging messages when pages to a phone’s temporary ID fail. An attacker who knows the paging slot can trigger that fallback; a fake tower can hijack the paging channel to block the network’s pages and then capture the carrier’s IMSI broadcast after a single silent call. The researchers validated this chained technique against one major US carrier.
Once an attacker has an IMSI, signaling-based techniques can be used to track location or intercept calls and texts.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildIMEI: the device identifier and when it matters
The IMEI (International Mobile Equipment Identity) is a unique number tied to your physical phone. Unlike the IMSI, the network does not authenticate the IMEI; it names the device without proving anything. In 4G and 5G, a basic fake tower typically collects the IMSI but not the IMEI because a phone sends its IMEI only after authenticating with the network.
That means an attacker generally must first downgrade the phone to an older network, or obtain authentication data through other signaling attacks (SS7 or Diameter), to capture an IMEI. Those signaling attacks themselves usually start with an IMSI. Separately, if a mobile carrier is compromised, whoever has access could track users by IMEI through the carrier’s systems.
Standards, downgrades and partial fixes in practice
Protections for identifiers vary by cellular generation. The 3GPP standards for newer generations improve identifier protection: 5G introduced SUCI encryption to avoid exposing the IMSI in the clear. But because 5G coverage is not universal, devices can be downgraded to 4G or earlier generations and become vulnerable in the same way. A fake tower can force such a downgrade and again exploit pre-authentication exchanges.
Cape’s Identifier Rotation and carrier-side defenses
Cape, described in the source as “America's privacy-first mobile carrier,” advertises a set of operational choices designed to reduce exposure. Cape says it collects the minimum information needed for service, deletes call and text metadata after 24 hours, rotates customers’ network IDs, and defends against SIM- and network-based attacks.
Specifically, Cape’s Identifier Rotation changes a customer’s IMSI every 24 hours (or on demand), cycling through seven IMSIs a week drawn from a shared, constantly reassigned pool. Cape argues that rotation makes harvested IMSIs “go stale,” moves the 4G paging fingerprint, and prevents IMSI catchers from building a multi-day history. Cape also describes pairing identifier rotation with other defenses and notes that combining Cape with GrapheneOS’s LTE-only mode blocks downgrades.
What this means for end users, researchers, and carriers
- End users: In environments where 5G with SUCI is not guaranteed, an attacker can still obtain an IMSI by downgrading a device or by exploiting paging behavior. Rotating IMSIs, as Cape proposes, breaks the long-term linkage attackers rely on, but does not stop an attacker from capturing a current IMSI in real time.
- Researchers and security teams: The 2019 paging demonstration and the validated fallback exploit show practical chaining between passive fingerprinting and active fake-tower techniques; defenders should be aware of multi-stage attacks that begin with a known phone number and move to IMSI harvests.
- Carriers and network defenders: The source material highlights two levers carriers can use: adopt standards and configurations that avoid falling back to broadcasting IMSIs, and operational choices such as short-lived metadata retention and identifier rotation to limit the value of any leaked identifier.
The technical arc is clear from the reporting: the IMSI remains the primary lever for many signaling and interception techniques, 5G introduces valuable protections but coverage gaps and protocol fallbacks preserve old attack surfaces, and operational moves — deletion policies and identifier rotation — can blunt long-term tracking even if they do not eliminate real-time capture. How widely carriers adopt those operational mitigations, and how networks are configured to avoid IMSI fallback, will determine whether arrests like the April 2026 SMS blaster case remain isolated incidents or signal a larger, ongoing exposure.
