IMSI vs MSISDN vs ICCID: the mobile identifiers, explained

The IMSI identifies a mobile subscription and lives on the SIM, the MSISDN is the subscription's phone number, and the ICCID is the serial number of the SIM card or eSIM profile itself. The home network links all three, which is how a number survives a new SIM or a move to another operator. The MSISDN is meant to be shared; the IMSI is meant to stay inside the network, and number-lookup APIs, ours included, should never expose it.

#What are IMSI, MSISDN and ICCID in one sentence each?

• IMSI (international mobile subscriber identity): the permanent identifier the network uses to recognise and authenticate a subscription, stored on the SIM or eSIM profile.
• MSISDN (Mobile Station International ISDN Number): the phone number of the subscription in full international form, the thing people dial.
• ICCID (integrated circuit card identifier): the unique serial number of the SIM card or eSIM profile.

A fourth identifier completes the picture:

• IMEI (international mobile equipment identity): the serial number of the phone itself.

All four are defined in public standards. The structure of the IMSI, MSISDN and IMEI is in 3GPP TS 23.003, Numbering, addressing and identification (3GPP TS 23.003). The ICCID is defined for the card in ETSI TS 102 221, with its contents taken from ITU-T E.118 (ETSI TS 102 221).

#How do the identifiers compare?

#What is an IMSI, and how is it built?

The IMSI is the network's own name for a subscription. When a phone attaches to a network, the network uses the subscription's identity to find its records, check that the SIM is genuine and decide which services it may use.

3GPP TS 23.003 says an IMSI "shall consist of decimal digits (0 through 9) only" and that "the number of digits in IMSI shall not exceed 15". It has three parts (3GPP TS 23.003):

1. MCC (mobile country code), three digits, which "identifies uniquely the country of domicile of the mobile subscription". MCCs are assigned by the ITU under Recommendation E.212.
2. MNC (mobile network code), two or three digits, which identifies the home network within that country.
3. MSIN (mobile subscription identification number), which identifies the subscription within that network.

The MCC and MNC together form the home network's code. That pair is public reference data, listed by regulators and used in routing. Our MCC/MNC glossary entry explains it. The MSIN, and therefore the full IMSI, identify one subscriber. Those are sensitive. The IMSI glossary entry has the short definition.

In 5G, the permanent identity is called the SUPI, which is usually an IMSI. It is sent over the air in protected form as the SUCI, which TS 23.003 describes as "a privacy preserving identifier containing the concealed SUPI" (3GPP TS 23.003). The standards have spent years reducing how often the permanent identity is exposed, for good reason.

#What is an MSISDN, and how does it relate to E.164?

The MSISDN is simply the mobile number in full international form, written without the plus sign. TS 23.003 says MSISDNs "(i.e. E.164 numbers) are assigned from the E.164 numbering plan" and consist of a country code (CC) followed by the national significant number, which is the national destination code (NDC) plus the subscriber number (SN) (3GPP TS 23.003).

Take the UK test number +44 7700 900001:

Because it follows E.164, an MSISDN has at most 15 digits. See the MSISDN glossary entry and our E.164 developer guide for parsing and storage.

One thing an MSISDN does not reliably tell you is the network. The NDC shows which operator the range was allocated to. After mobile number portability, another operator may serve the number. Finding the current network takes a lookup.

#What is an ICCID?

The ICCID is the SIM card's own serial number. ETSI TS 102 221 defines a file on every card, EF ICCID, that "provides a unique identification number for the UICC". It is 10 bytes long, coded in BCD, its contents follow ITU-T E.118, and its update access is set to "never" (ETSI TS 102 221). Ten BCD bytes hold up to 20 digits, which is why ICCIDs are longer than phone numbers. ITU-T E.118 is titled Numbering resources for cards to identify accounts for charging telecommunication services; its current version dates from September 2025 (ITU-T E.118).

You meet the ICCID when you activate a SIM, when a support agent asks for the long number printed on the card, or in a phone's "About" screen. An eSIM profile has an ICCID too. It identifies the card or profile, not the person and not the phone number.

#What is the IMEI, and why is it not the IMSI?

The IMEI identifies the device. TS 23.003 defines it as an 8-digit Type Allocation Code (TAC), a 6-digit serial number and a check digit, and notes that TACs are issued by the GSMA (3GPP TS 23.003). Put a SIM into a new phone and the IMEI changes while the IMSI, ICCID and MSISDN stay the same. Operators use the IMEI to block stolen handsets.

#Which identifiers change when you port, swap a SIM or change phone?

This table is the practical core of the topic, because fraud and data-quality problems live in these transitions.

Two rows explain two risks. A SIM swap keeps the number and moves it to a SIM someone else holds, so SMS codes arrive on the wrong phone with nothing visibly wrong. A reassigned number keeps the digits but changes the person, so your stored contact now reaches a stranger. Our guides to SIM swap fraud signals and the Reassigned Numbers Database cover each in depth.

#Why is the IMSI sensitive, and why do we never expose it?

A phone number is shared with hundreds of people. The IMSI is not, and the network uses it as the key to a subscriber's records. Someone who holds a person's IMSI together with signalling access may be able to link that person to network activity, which can help with tracking and with attacks on their accounts. That is why the standards conceal it over the air in 5G, and why signalling abuse over SS7 has long been a concern.

A raw reply from a home subscriber register can contain the IMSI, the address of the serving switch and other routing identifiers. MobileValidate discards them. We never return or store the IMSI, the MSIN, switch or register addresses, or cell and location codes. Roaming is reported only as true or false. The network is identified by name and MCC/MNC code, which is public reference data. MobileValidate doesn't offer a SIM-swap check either: SIM-change data belongs to operators.

A business needs to know "is this number live, and which network is it on?". It doesn't need anything that identifies or locates the SIM. Here is what an HLR lookup returns instead. With a test key, +447700900006 answers reachable with ported: true; see test mode.

curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900006"], "checks": ["hlr"]}'

The attributes of checks["number.hlr"] are status (reachable, unreachable, invalid or unknown), ported, roaming (true or false), network, mcc_mnc and country. That's all. An HLR lookup costs $0.005 per number at the time of writing, and unknown answers are free; see pricing.

If you only need the current network, the MNP lookup returns porting and the current mcc_mnc for $0.001 per number. If you need the line type (mobile, landline, VoIP), use the carrier lookup. Our comparison of HLR vs MNP vs number validation helps you choose.

#What should developers store?

• Store the E.164 number as the customer's identifier and contact address. It's what users know and what every API accepts.
• Store network facts with a timestamp: current MCC/MNC, line type, checked_at. They change with porting, so compare snapshots rather than trusting old ones.
• Don't collect IMSI, ICCID or IMEI unless you are an operator or a device manager with a clear need. They add risk and rarely add value to a sign-up or messaging flow.
• Mask numbers in logs. We do the same: full phone numbers never appear in our logs.

Our privacy checklist for phone and e-mail checks has the full list.

#Key takeaways

• MSISDN = the phone number (E.164, at most 15 digits, public). IMSI = the subscription's identity on the SIM (MCC + MNC + MSIN, at most 15 digits, private). ICCID = the SIM card's serial (up to 20 digits). IMEI = the phone.
• The home network maps MSISDN to IMSI, which is why numbers survive new SIMs and porting.
• Porting keeps the MSISDN and changes the IMSI and ICCID; a SIM swap keeps the number and changes the SIM behind it.
• The MCC/MNC pair is public; the full IMSI identifies one subscriber and should never leave the network.
• MobileValidate never returns or stores IMSIs or location identifiers. HLR answers report reachability, porting, roaming as true/false and the network's MCC/MNC.