International mobile subscriber identity (IMSI)

The IMSI (international mobile subscriber identity) is the unique, permanent identifier of a mobile subscription. It is stored on the SIM card or eSIM profile and used by mobile networks to recognise the subscriber, authenticate the SIM and route network procedures. Unlike the phone number, it is meant to stay inside the network and is not shown to other people.

#What does an IMSI consist of?

The IMSI is defined by ITU-T Recommendation E.212, The international identification plan for public networks and subscriptions, and in 3GPP TS 23.003. It has at most 15 digits in three parts:

• MCC (mobile country code): 3 digits identifying the country.
• MNC (mobile network code): 2 or 3 digits identifying the operator in that country.
• MSIN (mobile subscription identification number): the remaining digits, identifying the subscription within that operator.

The MCC and MNC together identify the home network. That pair is public reference data. See MCC/MNC. The MSIN, and the full IMSI, identify one subscriber and are sensitive.

#How is the IMSI different from the phone number?

The phone number, or MSISDN, is the public address people dial. The IMSI is the internal identity of the SIM. The home subscriber register maps one to the other. That separation lets an operator move a number to a new SIM, and it is also what attackers abuse in a SIM swap.

The IMSI is also different from the IMEI, which identifies the handset rather than the subscription.

#Why is the IMSI sensitive?

A phone number is widely shared. The IMSI is not, and networks use it as the key to a subscriber's records. Someone who holds a person's IMSI, together with other signalling data, may be able to link that person to network activity, which can help with tracking or with attacks on their accounts. For that reason, mobile standards have steadily reduced how often the permanent identity is exposed. In 5G, the permanent identifier (SUPI, which is usually an IMSI) is sent over the air only in concealed form, as the SUCI, per 3GPP TS 33.501.

Network-level exposure of identifiers is part of a wider signalling risk class. See SS7.

#Why does MobileValidate never return an IMSI?

Raw replies from a subscriber register can contain the IMSI, the address of the serving switch and other routing identifiers. MobileValidate's policy is to discard them:

• We never return or store the IMSI, the MSIN, switch or register addresses, or cell and location codes.
• Roaming is reported only as a yes/no flag or a country, never as a location.
• The network is identified by its name and MCC/MNC code, which is public reference data.

A number-intelligence service needs to answer "is this number live, and on which network?". It doesn't need anything that identifies or locates the SIM. Our trust page describes how we handle data.

#How does this affect what you get from an HLR lookup?

The upcoming HLR lookup will return status, ported, roaming, network, mcc_mnc and country. That is enough to decide whether to send, call or route a number, without exposing the subscriber. See HLR lookup for how the query works. The carrier lookup returns the line type and current carrier from reference data.