How IMSI Catchers Work and Why Your Carrier Can't Protect You

An IMSI catcher is a device that pretends to be a cell tower. Your phone connects to it thinking it’s talking to AT&T or T-Mobile, and the device captures your IMSI (International Mobile Subscriber Identity), the unique number that identifies your SIM card on the network. Once someone has your IMSI, they can track your location, intercept your calls and texts, and follow your movements across the city.

You’ve probably heard these called Stingrays, which is a brand name from Harris Corporation. Law enforcement agencies across the US use them routinely, often without warrants. But the technology isn’t limited to cops. The hardware to build a basic IMSI catcher costs around $200 in parts, and there are open-source software projects that walk you through the setup. Anyone with modest technical skills and a weekend to spare can build one.

How the attack works

Your phone is constantly looking for the strongest cell signal nearby. That’s how handoffs work when you’re driving down the highway. Your phone drops the weaker tower and connects to the stronger one automatically. An IMSI catcher exploits this by broadcasting a stronger signal than the real towers in the area. Your phone sees the stronger signal, assumes it’s a legitimate tower, and connects.

Once your phone connects, the IMSI catcher captures your IMSI and can see your phone’s location. More advanced setups can force your phone to downgrade from 4G or 5G to 2G, which has weaker encryption, making it possible to intercept the actual content of calls and texts. The whole process is invisible to you. Your phone doesn’t alert you. There’s no notification. It just connects and starts sending data to the wrong place.

The paging attack

There’s a subtler angle to IMSI catchers that most people don’t know about. Your phone doesn’t stay connected to a tower 24/7. To save battery, it goes into idle mode and periodically “wakes up” to check if the network has any messages for it. This is called paging, and the timing of when your phone checks in is determined by your IMSI.

Because your IMSI never changes on a traditional carrier, the paging schedule is predictable. An attacker who knows your IMSI can predict exactly when your phone will wake up and listen for paging messages. They can then send targeted paging requests during that window to confirm your presence in an area. This works even if they can’t intercept your calls. Just confirming that your phone is in a specific location at a specific time is valuable intelligence.

Why your carrier doesn’t fix this

The fundamental problem is how cellular networks are designed. Your phone is supposed to trust cell towers. That trust model made sense in the 1980s when building a cell tower required millions of dollars and government licensing. It doesn’t make sense in 2026 when the hardware costs less than a nice dinner.

Your carrier can’t fix this without changing how phones authenticate to towers, which would require coordinated changes across every carrier, every phone manufacturer, and every standards body. 5G has some improvements here with better mutual authentication, but most areas still fall back to 4G and even 3G, where the old vulnerabilities remain. And the carriers have no financial incentive to accelerate the fix because IMSI catchers don’t cost them money. They cost you privacy.

How Cape handles this differently

Cape’s IMSI rotation changes your IMSI every 24 hours, and you can trigger a manual rotation anytime. This doesn’t prevent your phone from connecting to an IMSI catcher (that’s a hardware-level issue), but it dramatically reduces what the attacker gets from it.

If someone captures your IMSI today, tomorrow it’s a different number. They can’t use yesterday’s IMSI to find you today. The paging attack breaks down too, because the paging schedule changes with the IMSI. An attacker who mapped your paging windows on Monday has useless data by Tuesday.

Long-term tracking becomes impractical. Traditional IMSI catcher surveillance depends on the identifier staying constant so you can correlate sightings over days, weeks, and months. With Cape, each day’s IMSI is effectively a different phone from the attacker’s perspective. They’d have to re-identify you every single day, which turns passive surveillance into an active and expensive operation.

Cape’s network lock adds another layer by protecting against SS7-based attacks that are often used alongside IMSI catchers. Once an attacker has your IMSI, SS7 exploits are the typical next step for intercepting calls and texts. Cape blocks those at the network level.

The reality for most people

Most people will never be individually targeted by an IMSI catcher. But “most people” is doing a lot of heavy lifting in that sentence. Journalists covering sensitive stories, lawyers handling high-profile cases, activists organizing protests, executives with access to valuable information, and anyone going through a hostile divorce or custody battle are all realistic targets. IMSI catchers have been found at protests, near courthouses, and in commercial districts.

Even if you’re not a specific target, IMSI catchers deployed in public spaces sweep up everyone in range. Law enforcement deployments have been documented to capture data from thousands of phones while looking for a single suspect. You don’t have to be the target to get caught in the net.

Save $20/month with a referral code

If you want to try Cape, grab a free referral code at cape.rip before you sign up. It takes $20 off your monthly bill for as long as you stay subscribed, and the person who shared the code saves $20 too. No signup needed, no tracking. Just pick a code and use it at cape.co.