Phone Calls Could Leak Your IMEI Before You Answer

Incoming Calls Could Reveal Your Phone’s IMEI Before You Answer

• Your Phone Could Reveal Its IMEI Before You Even Answer a Call
• Major Mobile Network Flaw Could Expose Smartphone Details to Callers
• Someone Could Learn Your Phone’s IMEI Just by Calling You
• Mobile Networks Warned After Calls Expose Smartphone Data
• Your Incoming Calls May Be Revealing More About Your Phone Than You Think

A newly uncovered security flaw in mobile networks could allow an incoming caller to obtain sensitive technical information about a smartphone before the person on the other end even answers.

The vulnerability was uncovered by Germany’s Bayerischer Rundfunk (BR), which found that some mobile networks could transmit a phone’s 15-digit International Mobile Equipment Identity (IMEI) along with information about the device model and software version during an incoming call.

The discovery has raised concerns among cybersecurity and privacy experts because an IMEI is a unique identifier associated with a mobile device. The information could potentially be used to build a profile of a target’s device, identify vulnerable software and support more targeted phishing or social-engineering attacks.

The call does not have to be answered

One of the most concerning aspects of the vulnerability is that the phone owner does not necessarily need to accept the call.

BR reportedly confirmed the issue through 70 test calls involving major German mobile networks. Researchers found that device information could be transmitted while the call was being established, before the recipient picked up.

The findings involved networks operated by Telekom, Vodafone and Telefónica’s O2, although the exact information exposed varied between operators. Cybernews reported that IMEI numbers were observed in some tests, while smartphone models and software information were also disclosed.

Why is an IMEI important?

An IMEI is designed to uniquely identify a mobile device. It is not a password and, by itself, does not give someone control of a phone.

However, security standards have long warned against unnecessarily exposing the identifier. The IETF notes that an IMEI can potentially be used to identify and track devices and should not be treated as an authentication credential.

The bigger concern is the combination of information.

If an attacker can determine the exact model of a target’s smartphone and identify its software version, they may be able to research known vulnerabilities affecting that particular device. Cybernews reported that the information could also help criminals create more convincing phishing and social-engineering campaigns.

More than 1,000 mobile operators warned

The discovery prompted the GSMA, the organization representing mobile network operators worldwide, to alert more than 1,000 operators and urge them to examine their networks and prevent unnecessary transmission of device information.

The issue appears to be connected to certain configurations of VoLTE services rather than a flaw affecting every smartphone directly.

German operators have already made technical changes intended to prevent the information leak. However, researchers have not established that mobile networks in every other country are protected against the same problem.

Could your phone be at risk?

For ordinary smartphone users, there is currently no indication that simply receiving a call means someone can automatically hack the device.

The more immediate privacy concern is that technical information about a phone could potentially be revealed to an unexpected caller without the user’s knowledge.

The discovery also highlights a broader problem in modern telecommunications: information exchanged behind the scenes between networks can create privacy risks even when users are doing nothing more than receiving a normal phone call.

For now, users should keep their smartphones and carrier software updated, remain cautious about suspicious calls and messages, and avoid giving callers personal information simply because they appear to know details about the device.

The investigation also serves as a warning to mobile operators worldwide: information that is necessary for a network to function should not automatically become visible to an untrusted caller.