What Is an IMSI? IMSI, SUPI and SUCI Explained

Every mobile subscription in the world has one permanent identifier that the network uses to recognise it: the IMSI, or International Mobile Subscriber Identity. It is not your phone number and it is not your phone's serial number. It is the identity of the subscription itself, stored on the SIM card and in the operator's subscriber database, and it is the identifier that IMSI catchers, signaling attacks and location tracking all revolve around.

This guide explains what an IMSI is, how to read one, why it is a privacy problem, and how 5G replaces it with two new identifiers, the SUPI and the encrypted SUCI.

What is an IMSI?

The IMSI is defined in 3GPP TS 23.003. It is a number of up to 15 digits made of three parts:

Together, the MCC and MNC identify the home network (the PLMN). The MSIN is the part that identifies you. For example, 001 01 0123456789 is a subscription on the test network 001-01, a code reserved for lab and test equipment and the one used in most private LTE and 5G labs.

The IMSI is written to the SIM (or USIM) when it is provisioned, and the home network keeps the same value in its subscriber database: the HLR in 2G and 3G, the HSS in 4G and the UDM in 5G. Moving the SIM to another phone moves the IMSI with it.

IMSI vs phone number vs IMEI

Three identifiers are easy to confuse:

• IMSI identifies the subscription. It lives on the SIM and is used inside the network. Users almost never see it.
• MSISDN is the phone number people dial. The network maps it to the IMSI; one IMSI can even have more than one number.
• IMEI identifies the device. It is burned into the phone, not the SIM, and stays the same when you change SIM cards.

An attacker who learns your IMSI can follow the subscription across devices. One who learns your IMEI can follow the handset across SIM cards. That is why both are prized by surveillance tools.

Why the IMSI is a privacy risk

Because the IMSI is permanent and unique, any party that can observe it can recognise the same subscriber again later. Mobile standards try to keep it off the air:

• In 2G and 3G, the network assigns a temporary identity, the TMSI, and the phone uses it instead of the IMSI whenever it can.
• In 4G LTE, the temporary identity is the GUTI.
• In 5G, it is the 5G-GUTI.

The weakness is the fallback. When a phone first attaches, or when the network says it does not recognise the temporary identity, the network can send an Identity Request and the phone answers with its IMSI. In 2G, 3G and 4G that answer is sent before authentication and encryption are in place, so it travels in clear text. A fake base station only has to ask.

That single design choice is what makes IMSI catchers and rogue base stations work: they impersonate a cell, ask every phone nearby for its identity, and log the IMSIs they receive.

The IMSI also travels between networks. Roaming partners exchange it over SS7 and Diameter, and some signaling queries return it in response to just a phone number. That is the basis of several SS7 attacks that look up a subscriber's IMSI before tracking or intercepting them.

SUPI: the 5G permanent identifier

5G introduces a more general permanent identifier, the SUPI (Subscription Permanent Identifier), defined in 3GPP TS 23.501 and TS 23.003. For a normal mobile subscription the SUPI simply is an IMSI: same MCC, MNC and MSIN. The SUPI can also take the form of a Network Access Identifier (NAI), which 5G uses for some non-3GPP access and private network cases.

The important change is not the SUPI itself but the rule around it: in 5G, the SUPI must never be sent over the radio in clear text. Instead, the phone sends a concealed version.

SUCI: the encrypted identity

The SUCI (Subscription Concealed Identifier), specified in 3GPP TS 33.501, is the SUPI encrypted with the home network's public key. Its main parts are:

• The home network identifiers, in clear text: the MCC and MNC, plus a routing indicator. The visited network needs these to know where to send the request.
• The protection scheme and key identifiers, which tell the home network how the identity was encrypted and with which key.
• The scheme output: the MSIN, encrypted.

The encryption uses ECIES, a public-key scheme, with one of two standard profiles. Profile A uses Curve25519 and Profile B uses the NIST P-256 curve. The phone generates a fresh ephemeral key for each SUCI, so two SUCIs from the same subscriber look completely different and cannot be linked to each other. Only the home network's SIDF (Subscription Identifier De-concealing Function), which sits in the UDM and holds the private key, can recover the SUPI.

The result is that a fake 5G base station that asks for the subscriber's identity receives a SUCI it cannot decrypt, rather than the IMSI.

The null scheme: when 5G does not protect the IMSI

SUCI protection only works if the operator has actually provisioned its public key on the SIM. The standard also defines a null scheme (protection scheme 0), in which the MSIN is placed in the SUCI without encryption. It exists for cases such as emergency calls without a SIM and for networks that have not provisioned keys, but in those networks the "concealed" identifier exposes the IMSI just as 4G did.

Null-scheme deployments, downgrades from 5G standalone to 4G, and non-standalone 5G (which still relies on the 4G core) are the main ways IMSI exposure survives into the 5G era. Our research on 5G SUCI null-scheme attacks covers how attackers find and exploit them.

Protecting subscriber identities

For operators:

• provision SUCI public keys on every 5G-capable SIM, and avoid the null scheme outside the cases the standard requires;
• prefer 5G standalone, where SUCI and the 5G security architecture apply end to end;
• filter SS7 and Diameter queries from roaming partners that return the IMSI for a phone number;
• monitor the radio network for cells that request identities unusually often, a common signature of IMSI catchers.

For subscribers the options are limited, because the IMSI cannot be changed without a new SIM. On phones that allow it, disabling 2G removes the easiest downgrade path for IMSI catchers.

Frequently asked questions

Learn more

Subscriber identity is one of the first topics in the TelcoSec Academy's GSM and SIM courses, which explain how the SIM authenticates a subscriber and how identities are protected and exposed across 2G to 5G.