IMSI Catchers (Stingrays): What They Are and How to Spot One

The name comes from the International Mobile Subscriber Identity, the identifier that tells a network which subscription a phone belongs to. Stingray is a brand that became a generic term the way hoover did. Both describe the same idea: a box that behaves like a tower so that handsets in range connect to it and reveal who they are.

We sell mobile connectivity, and this is a topic where our product does nothing, so what follows is a description rather than a pitch.

How the attack works

Phones are built to attach to whichever nearby tower offers the best signal, and historically they did so without demanding much proof that the tower was genuine. A device that broadcasts a strong, plausible signal therefore attracts the handsets around it.

Once a phone attaches, the fake tower can ask it to identify itself. At minimum that yields the subscriber identifier and often the device identifier, which is enough to confirm that a specific person is in a specific place, or to build a list of everyone present at a protest, a border crossing or a meeting.

The stronger versions go further and relay traffic onward to a real network, placing themselves in the middle. That is where interception becomes possible, and it is also where modern networks fight back hardest.

Why 2G is the weak point

In the oldest generation of mobile networks, the phone proves itself to the network and the network does not have to prove itself to the phone. That asymmetry is the whole vulnerability: a fake tower never has to pass a test, because no test exists.

Later generations added mutual authentication, so the network must prove itself too. Which is why the practical attack is usually not against 4G or 5G directly but a downgrade: jam or outcompete the modern signal until the handset falls back to 2G, then operate in the generation that cannot tell a real tower from a fake one.

So the defence is to remove the fallback. If the phone will not speak 2G at all, the downgrade fails and the attack loses its easiest path.

The setting that actually helps

Modern Android versions include an option to disable 2G entirely, usually in the network or SIM settings, and it is the single most useful thing on this page. On iPhone, Lockdown Mode disables 2G among other hardening measures, which is a blunt instrument but an effective one if your situation warrants it.

The cost is real but small for most people: in a few countries and in some rural areas, 2G is still the fallback that keeps calls working where nothing else reaches. If you travel somewhere that depends on it, you will notice. Almost everywhere else, you will not.

Beyond that, the ordinary hygiene applies and matters more than it sounds. Keep the operating system updated, because downgrade and baseband issues get patched. And use end-to-end encrypted messaging, so that even a device sitting in the middle of your connection sees traffic it cannot read.

What newer networks changed

This is the part most articles on the subject are a decade out of date on. In 5G standalone networks the permanent subscriber identifier is not transmitted in the clear: it is encrypted with the operator's key before it leaves the phone. The identifier an eavesdropper can collect is a concealed, rotating one rather than the permanent one.

That removes the passive collection the term IMSI catcher literally describes, at least on networks running in that mode. Two caveats keep it from being a solved problem. Plenty of 5G deployments are non standalone and still lean on older core infrastructure. And downgrade attacks remain available wherever older generations are still enabled on the handset, which is the reason the 2G setting matters so much.

• The attack is not clever radio work. It is a tower that never has to prove it is a tower, and a phone polite enough not to ask.

Can you detect one?

Honestly, not with an app on a normal phone. The detector apps in the stores generally rely on signals the operating system stopped exposing years ago, and what they produce is mostly false positives: a legitimate tower in an unusual configuration, a temporary cell at an event, a network doing maintenance.

Real detection is done with software defined radios and purpose built hardware, scanning for towers that behave oddly: no neighbours advertised, implausible signal strength, a configuration that encourages downgrade. That is research work, not something to run from a pocket.

The signals a normal user can notice are weak and ambiguous. An unexplained drop from 5G or 4G to 2G in a city with good coverage is the most meaningful one, which is another reason to disable 2G: it converts a thing you might notice into a thing that cannot happen.

Does an eSIM change anything?

No, and it is worth stating plainly because this is a privacy topic and we sell eSIMs. The subscriber identifier exists in the profile regardless of whether that profile lives on plastic or on an embedded chip. A fake tower treats both identically.

What buying without identity verification changes is a different layer entirely: whether a record exists at the seller linking a line to a named person. That is a meaningful distinction and a narrow one, and we set out exactly which layers it covers in what an anonymous eSIM really means.

→ Worried about tracking more broadly rather than this specific device? Read how to stop someone tracking your phone

Where Cypher eSIM stands

This article sells nothing, and that is deliberate. Our product does not defend against an IMSI catcher, and neither does anyone else's eSIM. What we sell is connectivity bought without an account, an email, a name or a card: data across 180+ countries from around $1.20 depending on destination, plans with a real number from $14.84 to $56.07 for 66 countries, paid in USDT on TRC-20, BEP-20, Arbitrum or Solana, plus BTC, ETH, SOL, USDC, DAI, XMR and TON. If this topic is the reason you are reading, the two useful actions are disabling 2G and using encrypted messaging, and both are free.

FAQ

What is an IMSI catcher?

A device that imitates a mobile tower so that handsets nearby attach to it and identify themselves. It can confirm that a particular phone is present in a particular place, enumerate the devices in an area, and in stronger configurations relay traffic in order to intercept it.

How do I protect myself from a Stingray?

Disable 2G on your phone, which modern Android allows directly and iPhone covers through Lockdown Mode. That removes the downgrade path the classic attack depends on. Then keep the operating system updated and use end-to-end encrypted messaging so content stays unreadable regardless.

Do IMSI catcher detector apps work?

Generally no. They depend on radio information the operating system no longer exposes to apps, so they produce mostly false positives. Genuine detection uses software defined radios and specialised analysis, which is research equipment rather than something you run on a handset.

Does 5G stop IMSI catchers?

Standalone 5G encrypts the permanent subscriber identifier before it is transmitted, which removes the passive capture the name describes. It is not a complete answer, because many deployments are not standalone and downgrade attacks still work wherever older network generations remain enabled on the phone.

Does using an eSIM protect me?

No. The subscriber identifier exists in the profile whether it sits on a plastic card or an embedded chip, and a fake tower cannot tell the difference. Buying without identity verification affects whether a seller holds a record about you, which is a separate layer entirely.