Field Guide · term

Also known as: IMSI, IMEI, International Mobile Subscriber Identity, International Mobile Equipment Identity

The IMSI (International Mobile Subscriber Identity) and IMEI (International Mobile Equipment Identity) are the two identifiers that let a cellular network tell who is calling apart from which device they are calling on.12 The IMSI belongs to the subscription and lives on the SIM; the IMEI belongs to the phone and is burned into the handset at manufacture.

SIM → IMSI MCC MNC MSIN handset → IMEI TAC (type) serial chk who vs. which
The IMSI (on the SIM) identifies the subscription as MCC + MNC + MSIN; the IMEI (in the handset) identifies the device as a type-allocation code, serial, and check digit.

How it works

The IMSI is up to 15 digits, split into three fields: a 3-digit MCC (mobile country code), a 2–3-digit MNC (mobile network code) identifying the operator, and the remaining MSIN (mobile subscriber identification number) identifying the account within that network. When a phone attaches to a network — part of the registration process — the network uses the MCC/MNC to know which operator to authenticate against. To avoid broadcasting the permanent IMSI over the air, the network quickly assigns a temporary alias (a TMSI in GSM, a GUTI in LTE) and uses that for most later signalling.

The IMEI is a 15-digit number identifying the physical equipment: an 8-digit Type Allocation Code (TAC) that encodes the make and model, a 6-digit serial number, and a Luhn check digit. A variant, IMEISV, appends a software-version field. Because the IMEI is device-bound, networks use it to bar stolen handsets via shared equipment-identity registers, independent of whatever SIM is inserted.

In practice

Keeping the two identities separate is what makes SIM swapping possible: move the SIM (and its IMSI) to a new phone and the subscription follows, while the phone’s IMEI stays with the hardware. An eSIM achieves the same split electronically, provisioning the IMSI into a soldered secure element instead of a removable card. The privacy risk in the permanent IMSI is precisely why temporary identifiers exist — and why a rogue “IMSI catcher” base station that forces phones to reveal their IMSI is a known surveillance concern.

Relevance to SDR

IMSI and IMEI are cellular identifiers, and on modern networks the permanent IMSI is deliberately hidden behind temporary aliases and, in 5G, encrypted, so it is not casually recoverable from the air. They are relevant to the SDR world as the canonical example of the subscriber-vs-equipment identity split, a pattern echoed in the land-mobile systems GopherTrunk does decode: a radio ID on a P25 or DMR system likewise names a unit on the network. GopherTrunk does not recover IMSI or IMEI — cellular attach signalling is out of scope for its land-mobile air interfaces, and these identifiers are protected on contemporary networks. They are documented here for context on how cellular identity works.

Sources

  1. International mobile subscriber identity — Wikipedia, for the IMSI’s MCC/MNC/MSIN structure and its storage on the SIM. ↩

  2. International Mobile Equipment Identity — Wikipedia, for the IMEI’s TAC/serial/check-digit structure and its role in barring stolen devices. ↩

See also