What is IMSI? The international mobile subscriber identity

The IMSI, short for international mobile subscriber identity, is the number a mobile network uses to recognize a subscription. It is stored on the SIM, it is up to 15 digits long, and its first digits say which country and which network the subscription belongs to. When a phone or an IoT module connects, the network uses the IMSI to find the subscription’s records and to check that the SIM holds the matching secret key. This article explains how the number is built, how the network uses it, how modern networks keep it from being broadcast, how it differs from the IMEI, the ICCID and the phone number, how to read it from a device, and why IoT SIMs sometimes carry more than one. (IMSI is also the name of an IVF technique; this article is about the mobile identity only.)

What the IMSI is

The IMSI is defined by the ITU in Recommendation E.212 and by 3GPP in TS 23.003, the specification for numbering and identities in mobile networks. It is assigned by the operator that issues the subscription and written into the SIM, in a file the device reads when it starts.

Each subscription has its own IMSI. A plain SIM card carries one. An eSIM or eUICC carries one per operator profile, so downloading a new profile gives the device a new IMSI, while the chip’s own identity, the EID, stays the same; the IoT SIM card guide covers eSIM profiles. The IMSI is not the phone number and is not printed on the card.

On the network side, the IMSI is the key to the subscriber’s record in the home network’s database: the HLR in 2G and 3G, the HSS in 4G, and the UDM in 5G. That record holds what the subscription is allowed to do, which network it is currently using, and the secret key shared with the SIM.

The structure of an IMSI

An IMSI has three parts.

The mobile country code (MCC) is three digits and identifies the country, or for some international and satellite networks a shared code. Larger countries have several; the United States uses codes from 310 to 316. The mobile network code (MNC) is two or three digits and identifies the operator within that country; Europe mostly uses two-digit MNCs and North America three. The mobile subscription identification number (MSIN) is the operator’s own number for the subscription, and makes up the remaining digits.

The MCC and MNC together are the PLMN ID, the identity of a public land mobile network, and they tell any network in the world which home network a visiting device belongs to. That is how roaming works: a network in another country reads the first five or six digits, finds the home operator, and asks it whether to let the device on. The MNO and MVNO article explains how operators and resellers get their own network codes.

How the network uses the IMSI

When a device attaches to a network for the first time, it identifies itself, and the network has to check that the claim is genuine. In outline:

1. The device sends its identity: the IMSI, or in 5G a concealed form of it.
2. The network it is attaching to, which may be a roaming partner, asks the home network for authentication data for that subscriber.
3. The home network looks up the subscriber’s secret key and produces a random challenge and the answer it expects.
4. The device’s SIM computes its answer from the challenge and the same key, which never leaves the SIM.
5. If the answers match, the device is in, and both sides derive keys to encrypt the connection.
6. The network gives the device a temporary identity to use from then on.

Keeping the IMSI off the air

Because the IMSI is permanent and tied to one subscriber, anyone who can collect it can track that subscriber. Networks therefore send it over the radio as little as possible.

Temporary identities. After the first attach, the network issues a temporary identity, the TMSI in 2G and 3G and the GUTI in 4G and 5G, and the device uses that instead. The network changes it from time to time, so a listener sees short-lived numbers that are hard to link to one person or device.

IMSI catchers. Before 5G, a network could still ask a device for its permanent IMSI in plain text, for example when it did not recognize the temporary identity. A fake base station, called an IMSI catcher, exploits that: it imitates a real network, devices nearby connect to it, and it asks each one for its IMSI. Some also try to push devices down to 2G, where the older security has known weaknesses.

5G SUCI. 5G closes that gap. The permanent identity is called the SUPI, and for SIM-based subscriptions the SUPI is the IMSI. The device never sends it in clear: it sends a SUCI, a subscription concealed identifier, in which the MSIN is encrypted with the home network’s public key and only the routing part, the MCC and MNC, stays readable. Only the home network can decrypt it. The protection depends on the operator enabling it and on the device and SIM supporting it, and it does not help a device that falls back to an older network.

IMSI vs IMEI vs ICCID vs phone number

A connected device has several identities that are easy to mix up.

The ICCID, its digit structure and where to find it are covered in the ICCID number article. Moving a phone number to a new operator keeps the number and brings a new SIM, so the IMSI and ICCID change while the number stays. Many IoT SIMs have no voice number at all, or a number that nobody dials, and are tracked by ICCID and IMSI alone.

How to read the IMSI

On a cellular module, the standard AT command AT+CIMI from 3GPP TS 27.007 returns the IMSI. Device firmware commonly reads it at start-up along with the IMEI and ICCID and reports all three, so the fleet platform can match a device to its subscription.

Phones rarely show the IMSI in their settings, and recent versions of Android stop ordinary apps from reading it. Network diagnostic tools and the operator can see it. For an IoT fleet, the connectivity provider’s management platform lists the IMSI for each SIM, usually alongside the ICCID.

Multi-IMSI SIMs and IoT

A device fixed in a basement or on a remote pole cannot move to find a better network, and a single home operator’s roaming agreements may not cover every country a product ships to. Some IoT SIMs carry several IMSIs from different operators and switch between them, so the device appears to belong to whichever home network gives the best access where it is. The switching is done by an applet on the SIM, sometimes steered over the air by the provider, and the IoT SIM card guide compares it with roaming SIMs and eSIM.

That has one practical consequence for fleet records: the IMSI a device reports can change without any hardware being touched. Key the device’s records on the ICCID or on the device’s own ID, store the current IMSI as an attribute, and expect it to change.