What is an IMSI, and why the number outlasts the handset

An international mobile subscriber identity is a numeric string of up to fifteen digits, assigned by an operator to a subscription and stored on the subscriber module that the subscription is delivered on. It has three parts. The first names the country. The second names the operator within that country. The rest is the operator’s own serial allocation, unique within its own space and meaningless outside it.

That structure exists for routing. A network in another country that receives an attach request needs to know, immediately and without asking anyone, who to contact about this subscription: which country, which operator, where the record is held. The leading digits answer that question directly, which is what makes roaming possible without every network holding a copy of every other network’s subscriber list.

It is worth being precise about what the number is not. It is not a telephone number. The number people dial is a separate identifier that the operator maps onto the subscription and can change without touching the identity underneath, which is why porting a number between operators works at all. It is not a device identifier either, a distinction with practical consequences set out on the comparison page. And it is not a secret: it was never designed to be one, which is the root of the problem described below.

The identity is allocated once and then persists for the life of the subscription. It survives the handset being replaced, the battery going flat, travel between countries and years of service. For the operator this is the whole point: billing, authentication, lawful access and the ability to recognise a returning subscriber all rest on the identity meaning the same thing over time.

For anyone collecting it, the same permanence is what gives it value. A number that is unique, stable and tied to an account is a durable handle on a person, and unlike a browser identifier it cannot be cleared, rotated or refused. Observations of the same identity in different places at different times can be joined together with no further work, because the identity itself does the joining.

Mobile networks recognised this early and introduced temporary identities to keep the permanent one off the air. Once a subscription is known to a network it is given a short-lived identifier and addressed by that instead, which works well in steady state. The gap is at the edges: when a handset arrives somewhere new, when the temporary identity has expired, and whenever the network says it does not recognise the temporary one and asks for the permanent identity instead. Those moments are ordinary, they happen routinely, and an attacker can manufacture them, which is what turns a routing number into a tracking token.

The fifth generation renamed the concept and changed how it travels. The permanent identifier is still there, still allocated by the operator and still stored on the module, but it is no longer supposed to cross the air interface in a readable form: it is encrypted to the home operator before it leaves the device, so a listener sees a value that is useless for recognising the same subscription twice. The concealment page covers what that does and does not achieve.

The renaming has not made the old term obsolete, for two reasons. Older network generations are still running, in most places alongside the new one and in some places instead of it, and on those generations the permanent identity behaves exactly as it always did. And the newer identifier is a superset, not a replacement: an operator identity on a fifth-generation network can be the same numeric string that the earlier generations called an international mobile subscriber identity, carried under a different name and, when concealment is used, in a different envelope.