IMSI vs IMEI: which number identifies the subscriber

A mobile network has to keep track of two different things that happen to arrive together. There is a subscription, which is a commercial relationship with an account, a tariff and a set of permissions, and there is a piece of equipment, which is a physical radio with a model, a manufacturer and a service history. These are separate because they vary independently: one subscription passes through several handsets over its life, and one handset carries several subscriptions.

So each gets its own identifier. The subscriber identity names the subscription and lives on the removable or embedded module that the subscription is delivered on; its structure and its properties are described separately. The equipment identity names the hardware, is written into the device during manufacture, and stays with it regardless of whose subscription is inserted.

Both are presented to the network, and that is the fact from which everything else on this page follows. The network does not have to choose between them or infer one from the other: it sees the pair, and it can record the pair.

Taken alone, each identifier supports one obvious operation. The subscriber identity lets the network find an account. The equipment identity lets it recognise a device, which is what makes it possible to refuse service to a handset reported stolen without knowing anything about who is holding it.

Taken together, they support something neither supports alone: continuity across a change of either one. A subscription that appears in a new handset is recognisable by its identity. A handset that appears with a new subscription is recognisable by its equipment number. In both cases the unchanged half carries the association forward, and the record of the pair is what links the old state to the new one.

This is why the common advice to change one or the other tends to disappoint. Replacing the module changes the subscription and preserves the hardware. Replacing the handset changes the hardware and preserves the subscription. Either move leaves an unbroken thread, and the thread is visible to the party best placed to follow it. Only changing both at once, and not using them in the same places or at the same times as before, breaks the link, and at that point the difficulty becomes behavioural.

An interception device standing in for a cell is normally after the subscriber identity, for a straightforward reason: that is the identifier the network can turn into an account, so it is the one that produces an answer to the question of who. The equipment number identifies a thing, and a thing has to be connected to a person by other means before it is much use.

There is a secondary use for the equipment number that is worth knowing about, which is recognition without identification. A device that has collected a pair once can recognise the same hardware later even if the subscription has changed, and it can do so without ever learning a name. For someone who changes cards as a precaution, that is the precise mechanism by which the precaution fails.

The countermeasure standardised in the fifth generation applies to the subscriber identity: it is concealed before transmission, so it is no longer available to be collected this way. The equipment number is treated differently, because the network has purposes for it that concealment would break, and the result is that the two identifiers now have genuinely different exposure. That asymmetry is new, and it is not yet widely reflected in the advice people are given.