IMSI Catchers and Stingrays: How They Work and How to Block Them
An IMSI catcher, often called a Stingray, can imitate cellular infrastructure to identify and track nearby phones. This guide explains how IMSI catchers work, what data they can capture, how difficult they are to detect, and which practical measures, including disabling 2G, using encrypted apps, and changing subscriber identifiers, can help reduce exposure
By GhostSims Team ·
If you are a journalist protecting sources, an executive handling sensitive information, a frequent traveller, or simply someone who does not want a mobile network connection turned into a tracking signal, IMSI catchers deserve your attention. The problem is that your phone has to identify itself to cellular networks before apps, VPNs, or encrypted messengers can do much to protect you. GhostSims addresses part of that exposure through privacy-focused SIM technology and changeable subscriber identities, but no SIM can make cellular surveillance disappear. Understanding exactly what an IMSI catcher can and cannot do is the first step toward building a realistic defence.
What Is an IMSI Catcher?
An IMSI catcher is a device designed to identify or track mobile devices by imitating cellular network infrastructure. In the United States, cell-site simulators are commonly associated with the name Stingray, originally a product name that became widely used as shorthand for this category of surveillance equipment.
IMSI stands for International Mobile Subscriber Identity, a subscriber identifier associated with a SIM or mobile subscription.
A cell-site simulator transmits radio signals that make nearby phones treat it as an attractive cellular connection. Phones responding to the simulated site can reveal identifying and signalling information that helps the operator distinguish one device from another. The U.S. Department of Justice describes its cell-site simulators as transmitting like a cellular tower and receiving identifiers from devices in their vicinity.
The important point is that an IMSI catcher attacks a layer below Signal, WhatsApp, browsers, and conventional VPN apps: the cellular radio and subscriber-identification layer.
How Does an IMSI Catcher Work?
The simplified description is “a fake cell tower,” but the actual process is more nuanced.
1. The Simulator Advertises Itself as a Cellular Site
An active IMSI catcher transmits network information intended to make nearby phones connect or otherwise respond to it. A device may appear more attractive because of signal characteristics or network parameters rather than simply because it has the “strongest signal.”
2. Nearby Phones Respond
Once a handset interacts with the simulated site, the equipment can request or collect cellular identifiers and signalling information.
Depending on the network generation, device, configuration, and technique involved, identifiers may include permanent or temporary subscriber identifiers and potentially device-related identifiers.
This is what makes the technology useful for surveillance: the operator can attempt to associate a radio signal in a physical area with a particular handset or subscription.
3. The Operator Narrows Down the Target
A cell-site simulator can compare the identifiers of phones around it with a target identifier.
U.S. DOJ guidance explains that its equipment may initially receive identifying information from several nearby devices before isolating the target. It can then use signal strength and direction to help locate that device.
Think of it less like GPS and more like radio direction finding.
A Stingray does not necessarily ask your phone, “Where are you?” Instead, the operator can infer where the device is by moving the simulator, adjusting its positioning, and analysing radio measurements.
4. Some Attacks Attempt Network Downgrades
Older cellular technologies are particularly important here.
Google's Android security documentation describes 2G as presenting serious security and privacy risks because false base stations can attempt to downgrade devices to 2G, where weaker authentication properties make interception or traffic manipulation easier. Android therefore supports disabling 2G on compatible devices.
That is one reason an IMSI catcher discussion in 2026 cannot be limited to old GSM surveillance. Modern devices support newer protocols, but downgrade paths and more advanced LTE-oriented techniques still matter.
Who Uses Stingray Surveillance?
Cell-site simulators have legitimate law-enforcement and public-safety uses. The U.S. Department of Justice specifically identifies situations such as locating fugitives, supporting criminal investigations, and helping locate kidnapping victims.
The technology is not limited conceptually to government agencies, however.
Canada's Cyber Centre warns that the underlying technology has become accessible to a broader range of threat actors and identifies risks to executives, sensitive business operations, and high-profile individuals.
That creates several potential threat models:
lawful law-enforcement surveillance
intelligence and national-security operations
unauthorised surveillance
organised criminal activity
targeting of executives or sensitive organisations
research and cellular-security testing
The capabilities and legality of each deployment can differ dramatically.
What Can an IMSI Catcher Capture?
This is where a lot of online explanations become misleading.
Not every IMSI catcher has the same capabilities.
Subscriber and Device Identifiers
The fundamental purpose is identifying cellular devices or subscriptions. That may involve an IMSI or other permanent or temporary identifiers.
This can help an operator establish that a particular device is present in a location.
Approximate or Precise Radio-Based Location
A simulator can use signal information to help determine a target phone's location.
The DOJ specifically notes that its devices use relative signal strength and direction rather than downloading GPS coordinates from the handset.
That distinction matters. “Phone tracking” does not necessarily mean the surveillance device has accessed your GPS.
Cellular Metadata
Depending on the system being used, a surveillance platform may obtain signalling or metadata useful for identifying and following a cellular device.
Calls, SMS, or Data in Some Attack Models
Some rogue base-station attacks can attempt interception or manipulation, particularly when insecure legacy network behaviour is involved. Canada's Cyber Centre lists voice metadata, SMS or call content, and data activity among information that malicious IMSI-catcher deployments may attempt to obtain.
But this should not be interpreted as “every Stingray reads your texts.”
The DOJ requires the cell-site simulators covered by its policy to be configured so they do not collect communications content. Those devices are used for identifying and locating phones, not remotely downloading emails, photos, contacts, or stored messages.
What Can an IMSI Catcher Not See?
An IMSI catcher should not be treated as a magical tool that opens everything on your phone.
End-to-End Encrypted Message Content
If you communicate through a correctly implemented end-to-end encrypted service such as Signal, capturing the cellular transport does not automatically reveal the plaintext of those conversations.
The attacker may still observe cellular presence, radio behaviour, timing, or other metadata depending on the attack, but strong application-layer encryption protects the message content itself.
This is why secure messaging still matters.
It is also why secure messaging alone does not solve IMSI-catcher exposure.
Your Entire Phone Storage
A conventional cell-site simulator does not simply connect and download your camera roll, password manager, contacts, or stored documents.
Those would require different compromises, vulnerabilities, malware, physical access, or lawful device-search techniques.
Everything a VPN Protects
A VPN protects IP traffic between your device and the VPN endpoint. It does not stop your cellular modem from participating in cellular signalling before that encrypted tunnel exists.
That is why a VPN alone isn't enough when your threat model includes network-level identification.
How to Detect an IMSI Catcher
Here is the frustrating part: reliable detection from an ordinary phone is difficult.
Potential warning signs may include:
unexpected network-generation downgrades
unusual loss of service
suspicious cellular configuration changes
abnormal tower behaviour
sudden encryption-related warnings on supported devices
radio patterns inconsistent with surrounding legitimate sites
None of these proves an IMSI catcher is present.
Network problems happen naturally, and sophisticated false base stations can be designed to avoid obvious anomalies.
Tools such as SnoopSnitch have been developed to analyse mobile radio data for suspicious activity, but detection tools depend heavily on device hardware, modem access, operating system support, and the attack technique. Research evaluating consumer IMSI-catcher detectors has also found meaningful limitations in detection reliability.
Treat an alert as evidence to investigate, not definitive proof.
How to Block an IMSI Catcher or Reduce Your Exposure
There is no universal “Block Stingray” switch. Effective IMSI catcher protection comes from reducing several different attack opportunities.
1. Disable 2G Where Your Phone Supports It
This is one of the clearest practical mitigations.
Android allows supported devices to disable 2G at the radio level, preventing normal scanning and connection to 2G networks. Google specifically recommends this as protection against false-base-station downgrade attacks. Emergency calling is handled separately.
The trade-off is coverage. Some regions or roaming arrangements may still depend on 2G.
2. Keep the Phone and Baseband Updated
Operating-system and firmware updates can close vulnerabilities and add newer cellular-security controls.
Do not assume that installing a secure messaging application compensates for an outdated modem or device.
3. Use End-to-End Encryption
Use secure applications for communications whose content matters.
Even when cellular identifiers remain observable, end-to-end encryption makes intercepted network traffic much less useful to an attacker attempting to read message or call content.
4. Reduce Long-Term Identifier Correlation
A conventional subscription gives surveillance systems a relatively persistent identifier that can be correlated across observations.
GhostSims advertises changeable IMSI functionality, allowing the subscriber identity associated with the SIM to be changed rather than relying indefinitely on one static IMSI.
That can reduce the value of a previously recorded IMSI as a permanent tracking anchor.
But there is an important limitation.
Changing an IMSI does not make a connected phone invisible to an IMSI catcher. A current subscriber identity or temporary network identifier still has to participate in cellular signalling, and a surveillance system may use other information to correlate the handset.
Think of IMSI changes as correlation resistance, not an invisibility cloak.
5. Use Layered Privacy Controls
Network identity, IP traffic, application content, device security, and operational behaviour are different layers.
A realistic complete privacy setup therefore combines SIM-level privacy with secure apps, a hardened operating system, current firmware, sensible network settings, and careful operational security.
Also remember that IMSI catchers and SS7 attacks are different threats. An IMSI catcher generally interacts with devices through the local radio environment, while SS7 attacks target signalling relationships deeper inside telecom networks.
What a Privacy SIM Cannot Protect You From
A privacy-focused SIM can reduce persistent subscriber correlation. It cannot eliminate every source of mobile tracking.
A serious threat model should still account for:
handset identifiers and radio characteristics
Wi-Fi and Bluetooth exposure
application accounts
IP addresses
GPS and application location permissions
payment records
physical surveillance
malicious software
carrier-side records
behavioural patterns
5G also improves subscriber-identity privacy compared with earlier systems. 3GPP describes 5G's permanent subscription identifier, the SUPI, as being concealed through the SUCI mechanism rather than routinely transmitting the permanent identity in the same manner as older generations.
That is an improvement, not proof that 5G makes tracking impossible.
Mobile privacy works best as layers.
FAQ
What is an IMSI catcher?
An IMSI catcher is a cellular surveillance device that can impersonate or otherwise emulate cellular infrastructure so nearby phones reveal identifying or signalling information. It is commonly used to identify or locate mobile devices. “Stingray” is a widely used name for one family of cell-site simulators.
Are Stingrays legal?
It depends on the country, jurisdiction, operator, and circumstances. In the United States, DOJ policy generally requires federal law-enforcement agencies covered by that policy to obtain a search warrant supported by probable cause before deploying a cell-site simulator, subject to specified exceptions and additional legal requirements. Other agencies and jurisdictions can operate under different laws and policies.
Can Signal protect against IMSI catchers?
Signal can protect the content of Signal conversations through end-to-end encryption, but it cannot stop your phone's cellular modem from communicating with cellular infrastructure. An IMSI catcher may therefore still attempt to identify or locate the device even though it cannot simply decrypt properly protected Signal messages.
How do I know if my phone is connected to an IMSI catcher?
Usually, you cannot know with certainty from normal phone behaviour alone. Suspicious downgrades, strange network changes, or specialist monitoring tools may provide clues, but false positives and missed detections are possible.
Can turning off 2G stop Stingrays?
Disabling 2G substantially reduces exposure to attacks that depend on forcing the handset onto legacy 2G service. It does not stop every cell-site simulator technique, including attacks targeting newer cellular technologies.
How does an encrypted SIM help against Stingrays?
The useful distinction is subscriber correlation. A SIM that supports changing its IMSI can reduce dependence on one permanent subscriber identifier, making an old captured IMSI less useful as a long-term tracking anchor after the identity changes. It does not prevent all radio surveillance, device identification, or location analysis.
Build Privacy at the Cellular Layer
You cannot solve IMSI catcher surveillance with a single app. Secure messaging protects content. A VPN protects IP traffic. Modern device settings can reduce legacy network attacks. Subscriber-identity controls can make long-term cellular correlation more difficult.
If your threat model includes the cellular layer itself, explore the GhostSims encrypted SIM card and evaluate its changeable-IMSI and privacy features alongside the rest of your security stack.
Order Your Ghost SIM Online or Contact us on Whatsapp +44 7375 695524