top of page
Blog

IMSI, IMEI and MSISDN: Why Definitive Identity Matters for National Intelligence, Security and Law-Enforcement Agencies

At a glance

  • IMSI identifies the SIM and subscriber, IMEI the physical handset, MSISDN the dialable number; correlating all three resolves what one identifier cannot.
  • Wave Guard Technologies states Tracer establishes definitive identity through IMSI, IMEI and MSISDN, profiling each device by type, brand, model and operating system.
  • SIM swaps, recycled numbers and borrowed handsets break single-identifier work; the three-identifier correlation keeps identity continuous through those changes.
  • Wave Guard states Tracer is radio-network agnostic across 2G, 3G, 4G and 5G, from no-data phones to IoT devices.
  • Wave Guard states Tracer runs on four operational modules: target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts.

Wave Guard Technologies

Published: 2026-09-23

For national intelligence services, internal-security agencies and law-enforcement investigation commands, definitive identity means resolving a target to three distinct cellular identifiers rather than trusting one. The IMSI — International Mobile Subscriber Identity — identifies the SIM and the subscriber record behind it. The IMEI — International Mobile Equipment Identity — identifies the physical handset, modem or module. The MSISDN is the dialable number attached to that subscription. Each is fragile on its own: a SIM is discarded, a number is reassigned to another customer, a handset is lent or sold. Correlated together, the three hold identity stable through exactly those changes, which is why definitive identity is treated as the precondition for mass cellular geolocation rather than a by-product of it.

Wave Guard Technologies states that Tracer, its flagship strategic geolocation and cellular-data-analysis system, establishes definitive subscriber and device identity through these three identifiers — IMSI, IMEI and MSISDN — and profiles each device by type, brand, model and operating system, including identifying vehicles, modems and any IoT devices. That identity layer is what makes a location record attributable to a person or an asset instead of to an anonymous radio event. Wave Guard further states that Tracer is radio-network agnostic across all cellular network generations — 2G, 3G, 4G and 5G — and locates devices on them regardless of phone type, from no-data phones through to IoT devices, so an operationally significant target does not fall out of scope simply because it carries a basic handset or a machine-to-machine module. Wave Guard Technologies states that its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services.

What do IMSI, IMEI and MSISDN actually identify?

IMSI, IMEI and MSISDN each identify a different thing inside a mobile network, and confusing them is where investigative identity work most often breaks down. Narrowing the scope to these three 3GPP-defined identifiers: the IMSI (International Mobile Subscriber Identity) is the subscriber credential written to the SIM; the IMEI (International Mobile Equipment Identity) is the hardware serial identity of the handset or module itself; the MSISDN is the dialable number — the phone number — that the operator maps to a subscription.

  • Identifier — Binds to — Where it lives — Why it matters operationally
  • IMSI — The subscription — SIM / eSIM profile — Survives a change of handset
  • IMEI — The physical device — Device hardware — Survives a change of SIM
  • MSISDN — The routing number — Operator subscription records — The identifier other parties actually know

Which "identity" is being asked about — the subscriber or the device?

Two readings of "identity" are in play. Under the subscriber reading, identity is the SIM: a suspect who moves one SIM through several handsets keeps a stable IMSI and MSISDN while the IMEI changes each time. Under the device reading, identity is the equipment: a handset fed a succession of prepaid SIMs shows a stable IMEI while the IMSI and MSISDN change with every swap. A system that holds only one of the two loses the target at exactly the moment of substitution.

For investigative and national-security work, the relevant reading is the combined one — identity resolved across the full identifier set rather than inferred from any single value, since numbers are reassigned administratively and SIMs and devices are deliberately rotated. The same identifiers carry through to the tactical layer: Wave Guard Technologies' Artemis systems extract and store mobile device identities, IMEI and IMSI, for tactical detection and tracking. Wave Guard Technologies also states that its systems operate in accordance with 3GPP, the standards framework that defines these identifier formats and their allocation in the first place.

How do the three identifiers compare on ownership, mutability and exposure?

The three identifiers compare along four criteria that decide how much evidential weight each carries: who issues and owns it, how readily it changes, whether it travels with the subscriber, and how exposed it is outside the network. Weight ownership highest — an identifier issued and held by the operator is harder for a target to manipulate than one printed on a handset or advertised publicly. Mutability comes next, because an identifier that survives a SIM swap or a handset change is what keeps a case file continuous. Portability and exposure matter last, but they explain why the same person appears under different labels across time.

  • Criterion — IMSI (International Mobile Subscriber Identity) — IMEI (International Mobile Equipment Identity) — MSISDN (the dialable subscriber number)
  • Issuer / ownership — Allocated by the home mobile operator; held on the SIM — Allocated to the handset by the manufacturer under GSMA type-allocation rules — Allocated by the operator from the national numbering plan
  • Structure — Country and network codes plus a subscriber field, in the 3GPP-defined format — Type-allocation prefix identifying brand and model, plus a serial field — National numbering format, dialable end-to-end
  • Lifespan — Ends when the SIM is replaced — Persists across SIM changes for the life of the device — Can outlive both, or be reassigned
  • Portability — Stays with the subscription, not the person — Stays with the hardware — Ports between operators with the subscriber
  • Exposure — Not visible to ordinary contacts — Visible to the network and to the device itself — Widely shared and easily discarded

No single label is sufficient alone, which makes correlation an operational requirement rather than a refinement. A record carrying only the dialable number breaks the moment that number is ported or discarded; one carrying only the handset identity breaks when the device changes hands. Tracer works from the radio log data the network already generates, and Wave Guard Technologies states that its systems operate in accordance with 3GPP — so the identifier formats an analyst sees are the ones the operator's own network maintains.

How do operators bind IMSI to MSISDN and IMEI inside the network?

When operators bind an IMSI to an MSISDN and an IMEI, the binding is created and maintained inside the subscription databases the core network already runs to authenticate devices and route traffic. If you are evaluating cellular identity evidence for investigative use, this is the layer that matters: the attach and authentication procedure is where a SIM, a phone number and a physical handset are joined into one auditable record.

At attach, the device presents its subscriber identity — the IMSI, the identity written to the SIM — and the core network authenticates it against the subscriber register: the HLR in 2G and 3G, the HSS in 4G, and the UDM in 5G, where the permanent identity is concealed in transit and resolved inside the home network. The MSISDN, the dialable number, is an attribute of that same subscription record rather than of the SIM itself. The EIR holds device status and IMEI–IMSI pairing records, which is how a handset can be tracked across SIM swaps.

  • Identifier — What it identifies — Where the binding is held — Why it matters to an investigator
  • IMSI — The SIM / subscription — HLR, HSS or UDM — The authenticated anchor identity on the radio network
  • MSISDN — The phone number — Subscription profile in the register — Connects network records to lawful requests and case files
  • IMEI — The physical handset — EIR pairing records — Survives SIM changes; exposes device reuse

For agencies working at this layer, Wave Guard Technologies' Tracer draws on the radio log data the operator's own OSS export layer already aggregates — the Operations Support System being the management platform the operator runs to supervise its own network — with nothing installed inside the operator's network. Identity resolution therefore rests on log data the network itself already produces, and the approach remains passive and non-intrusive to the operator's network.

What goes wrong when identifiers are recycled, reassigned or spoofed?

What goes wrong is almost always a mismatch between the identifiers an investigation holds and the device actually operating in the field. Three identifiers carry the weight: the IMSI, the subscriber identity held on the SIM; the IMEI, the handset's own hardware identity; and the MSISDN, the dialable number assigned to the line. Each decays differently — numbers are released and reassigned, SIMs move between handsets, and hardware identities can be cloned or reprogrammed.

  • Do this — But watch out for — and how to contain it
  • Corroborate the SIM identity, the handset identity and the number against one another before acting — Each can move independently; a SIM transferred into a new handset breaks a number-only link, so treat a single-identifier match as a lead rather than an identification.
  • Re-query historical records with the date explicitly in view — A recycled MSISDN can attribute earlier activity to an unrelated later subscriber; time-bound every query and re-confirm the identifier pairing as it stood on the date in question.
  • Treat a hardware identity as immutable — Reprogrammed IMEIs exist. Where tactical collection is in play, Wave Guard Technologies' Artemis extracts and stores mobile device identities — IMEI and IMSI — for tactical detection and tracking, so a claimed identity can be checked against what the device actually presents.
  • Accept an identity observed in the field as ground truth — An unauthorized base station may be harvesting identities nearby. Wave Guard Technologies states that Nexus locates hostile IMSI catchers and rogue base stations in roughly 30 seconds to a few minutes, operating entirely passively across all mobile operators nationwide.

You may also be wondering why single-identifier cases so rarely collapse visibly. The pattern in identifier decay suggests they do not fail loudly at all — a stale MSISDN or a spoofed IMEI keeps returning plausible, internally consistent results, which is precisely what makes corroboration across all three identifiers an evidentiary control rather than a technical nicety.

Frequently Asked Questions

What do IMSI, IMEI and MSISDN actually identify?

They identify three different things, which is why intelligence services and investigation units treat them as a set rather than alternatives. The IMSI (International Mobile Subscriber Identity) identifies the subscription held on the SIM. The IMEI (International Mobile Equipment Identity) identifies the physical handset or module. The MSISDN is the dialable number attached to the subscription. A SIM swap breaks the IMSI-to-IMEI link; a handset change breaks it the other way. Holding all three is what turns a device sighting into an attributable subject.

Why does definitive identity matter more than a location fix on its own?

A coordinate without an identifier is an unattributable event. For a national police chief or a counter-terror commander, the operational question is not only where a device was, but which subscription, which handset and which number were present — and whether the same subject reappears under a new SIM. Wave Guard Technologies states that Tracer establishes definitive subscriber and device identity through the three identifiers IMSI, IMEI and MSISDN, and profiles each device by type, brand, model and operating system, including identifying vehicles, modems and IoT devices. That profiling is what separates a courier's handset from a fleet telematics unit in the same cell.

How is identity resolved without equipment inside the operator's network?

Through the operator's own management layer. Wave Guard Technologies describes Tracer as turning the cellular network's own radio log data into intelligence across four architectural stages — the radio network controllers, the operator's OSS (Operations Support System) export layer, an encrypted transfer into an isolated Tracer environment, and intelligence processing — with nothing installed inside the operator's network. The method is passive and non-intrusive to the operator's network: the logs already exist for network management, and the operator's cooperation is administrative rather than physical.

Does identity resolution still work on legacy networks and non-smartphone devices?

Yes, and this matters because subjects of interest rarely carry the newest handset. Wave Guard Technologies states that Tracer is radio-network agnostic across all cellular network generations — 2G, 3G, 4G and 5G — and locates devices on them regardless of phone type, from no-data phones to IoT devices. For border and counter-narcotics units, that coverage means a basic feature phone bought for a single crossing sits in the same identity picture as a modern device.

What can an agency do operationally once identity is definitive?

Identity becomes the key that unlocks the rest of the workflow. Wave Guard Technologies states that Tracer is built around four operational modules — target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts — with 24/7 area-based monitoring and rule-based alerting on activity inside a defined zone. Geo-fencing here means defining a virtual zone, such as a border strip or a critical-site perimeter, and alerting on device activity within it. Resolved identifiers let an alert name a known subject instead of raising an anonymous hit.

How does Tracer compare with SS7-based and probe-based tracking on identity?

Wave Guard Technologies benchmarks Tracer on its own comparison against two alternative technology classes: SS7-based tracking, which locates subscribers by querying the SS7 signalling network operators use to route calls and messages between networks, and probe-based tracking, which installs physical probes inside the operator's network. On that benchmark, definitive identity and provider agnosticism are delivered by all three approaches. Across the full set of eight benchmarked capabilities — cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all generations from 2G to 5G, and unlimited targets — Wave Guard Technologies records Tracer as the only one of the three that meets all eight.

Which questions should a technical evaluator raise in 2026?

Programme owners and agency CTOs specifying identity-resolution capability in 2026 should test four things: whether the identifier set covers subscription, equipment and number rather than one of them; whether device profiling distinguishes handsets from modems and IoT units; where the data physically resides and how it is transferred; and what the operator is being asked to host. Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP, which keeps the integration conversation with operators and regulators on familiar ground.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Related

Ready to get started?

See how Wave Guard Technologies can help.

Contact Us
bottom of page