Your phone will connect to the strongest tower it hears. It does not ask for ID first. It assumes trust, and that assumption is the entire problem.
I first noticed this in 2019 outside a security conference in Las Vegas. My test Android dropped from LTE to 2G for 47 seconds, then returned to normal. No user notification. The baseband logs showed a cipher downgrade to A5/0, a location area code that did not exist in any public database, and a silent authentication request. I was running SnoopSnitch because I was testing detection methods for a client. The log was clean evidence of an IMSI catcher in operation.
That was six years ago, when the hardware still cost five figures. In 2026, you can build a functional LTE catcher for under $600 with open source software and a software defined radio. I know because I build them for red team exercises, then I build the tools to find them.
If you carry a phone, you have probably connected to at least one fake tower this year. Here is how I find them, and how you can too.
The Protocol Problem No One Fixed
Cellular networks were engineered for availability, not verification. Your device constantly transmits its presence to nearby towers. The tower with the strongest signal wins the connection. Only after attachment does the network authenticate the subscriber. The device never authenticates the network in 2G, and only partially in 4G and 5G.
Carriers maintain backwards compatibility with 2G for legacy devices and rural coverage. A fake tower exploits this by broadcasting a powerful 2G signal. Your modern phone, even a 2026 flagship, will downgrade to maintain service. During that downgrade, encryption is often disabled, and your IMSI and IMEI are transmitted in clear text.
In 4G and 5G networks, the attack is more subtle. Instead of forcing 2G, modern simulators broadcast a malformed 5G NSA cell that triggers a fallback to LTE with null integrity protection. The phone believes it is performing a normal handover. The user sees full bars.
This is not theoretical. I have captured these events in major US cities, at airports, and near government facilities. The devices are smaller now, often battery powered, and designed to operate for short durations to avoid detection.
Why Detection Matters in 2026
The threat model has shifted. Ten years ago, IMSI catchers were restricted to federal agencies. Today, the components are commercial off the shelf. A BladeRF x40, a Raspberry Pi 5, and srsRAN provide a complete LTE network in a package smaller than a textbook.
Private investigators use them for location tracking. Corporate security teams deploy them at events to monitor staff devices. Criminal groups use passive GSM sniffers, which cost about $35 in hardware, to harvest identifiers for SIM swap operations.
Passive sniffing is particularly common because it does not transmit, which keeps it outside many regulatory frameworks. An RTL-SDR dongle can log every IMSI within 500 meters without ever alerting the target device.
Your phone provides no native warning for any of this. iOS provides zero baseband visibility to users. Android provides limited access, and only on specific hardware with root access.
My Detection Methodology: Four Layers
I do not rely on a single application. Effective detection requires correlation across multiple data sources.
Layer 1: Baseband Monitoring on Android
For consistent detection, you need direct baseband access. On Qualcomm devices, this is possible with diagnostic mode.
SnoopSnitch remains the most reliable tool. Install from F-Droid, grant root, and enable active tests.
It monitors for:
- Cipher downgrades to A5/0, A5/1, or A5/2
- Location area code changes inconsistent with movement
- Missing neighbor cell lists
- Authentication requests without encryption
- Silent SMS type 0 messages
Run it continuously for at least seven days to establish a baseline. Real networks have quirks, but they are consistent quirks. A fake tower introduces anomalies that do not repeat.
For manual verification, use service mode.
Samsung devices: dial #0011#. Pixel devices: *##4636##
…then select phone information. Document your serving cell, physical cell ID, TAC, and band. If you observe a sudden shift from LTE band 2 to GSM 850 in an urban area with strong LTE coverage, that warrants investigation.
Layer 2: Tower Baseline Mapping
You cannot identify an anomaly without knowing normal. I maintain a personal database of legitimate towers for areas I frequent.
Use CellMapper to log cells during normal travel. Export the data weekly. I run a simple Python script that compares current serving cells against my historical database. Any cell ID that appears for less than three minutes and is not in OpenCellID or my logs gets flagged.
Key indicators in the data:
- TAC values of 1, 0, or 65535, which are reserved for testing
- MCC/MNC combinations that do not match local carriers
- Cells with no neighbor relations
- Signal strength above -55 dBm in an area where macro cells typically provide -80 to -95 dBm
A legitimate small cell will appear consistently. A portable simulator will appear once, then vanish.
Layer 3: SDR Spectrum Analysis
This is the most definitive method. A software defined radio sees the raw RF environment, independent of your phone's interpretation.
My field kit consists of a HackRF One, a telescopic antenna, and a laptop running SDR++. Total cost is approximately $350. For mobile use, I use an RTL-SDR v4 with an Android phone and RF Analyzer.
Procedure:
- Tune to the downlink bands for your region. In the US, this is 617-894 MHz and 1930-1995 MHz for LTE, and 3700-3980 MHz for C-band 5G.
- Observe the waterfall display. Legitimate towers produce stable, continuous carriers with consistent bandwidth.
- Look for transient carriers that appear suddenly at high power, operate for 5 to 20 minutes, then disappear.
- Decode the broadcast channel using gr-lte or srsRAN. Examine the SIB1 messages. Fake towers often omit the full PLMN list or broadcast incorrect tracking area codes.
I have identified simulators by their imperfect implementation of timing advance values. Real networks adjust timing continuously. Many open source implementations use a static value, which creates a detectable signature in the logs.
Layer 4: 5G and LTE Security Mode Analysis
Modern catchers target 5G to LTE fallback. Detection requires examining NAS messages.
On a rooted Qualcomm device, enable modem logging with QPST or use Android's built-in bug report to extract radio logs. Search for SecurityModeCommand messages. A security header type of 0 indicates no integrity protection. In commercial networks, this should never occur outside of initial attach, and even then only briefly.
Also monitor for repeated Authentication Request messages. A real network authenticates once per session. A catcher will often re-authenticate multiple times to harvest responses.
Practical Workflow
I have automated most of this process because manual review does not scale.
Daily operation: SnoopSnitch runs in background on a dedicated Pixel 6a. It uploads alerts to a private server. CellMapper logs continuously.
When traveling to sensitive locations: I activate the HackRF in my bag, recording IQ data to a 256GB SD card. The recording is time stamped with GPS.
Weekly review: I process the logs with a script that correlates three data points. If SnoopSnitch reports a cipher downgrade, CellMapper shows an unknown cell, and the SDR shows a transient carrier at the same time and location, that is a high confidence detection.
False positives occur. Network maintenance, temporary cells on wheels for events, and new small cell deployments can trigger alerts. I validate by checking carrier maintenance notices and by revisiting the location 24 hours later. Persistent anomalies are rare in legitimate infrastructure.
iOS Limitations and Workarounds
Apple provides no public API for baseband information. Field test mode, accessed via 3001#12345#, shows limited data but requires manual documentation.
For iPhone users, I recommend a two device approach. Carry a low cost Android device, such as a Motorola G Power, with no SIM card installed. Run SnoopSnitch and CellMapper in monitoring mode. The device will still scan and log surrounding cells without connecting to a network. If the Android detects an anomaly, assume your iPhone was also affected.
Alternatively, rely entirely on SDR monitoring. The RF environment is identical regardless of phone operating system.
What To Do Upon Detection
Do not engage with the suspected device. Enable airplane mode for 15 seconds to force network reselection, then move at least 200 meters from the location.
Document the event. Record time, GPS coordinates, serving cell ID, signal strength, and any application alerts. Preserve SDR recordings if available.
Do not immediately publish the data. Correlate with public sources first. Check the FCC spectrum dashboard for licensed temporary operations. Check local news for events requiring portable cells. Most legitimate deployments are documented somewhere.
In two years of active monitoring in three cities, I have documented four high confidence detections that did not correlate with legitimate activity. All four involved short duration cells with test PLMNs, null encryption, and signal strengths inconsistent with macro tower placement.
Building Long Term Situational Awareness
The goal is not to find every simulator. The goal is to understand your personal RF environment well enough to recognize when it changes.
Start by mapping your home and work locations. Spend one week logging. You will learn which bands your carrier uses, what signal levels are normal, and how cells hand over during your commute.
Once you have a baseline, anomalies become obvious. You will notice when your phone camps on an unusual band, or when a new cell appears with no history.
This skill set transfers directly to other areas of wireless security. The same SDR techniques apply to Wi-Fi, Bluetooth, and IoT protocols. The analytical mindset is identical.
If you want the complete hardware list, exact srsRAN configurations, the Python scripts I use for correlation, and the step by step process for building a portable detection kit, I documented everything in my field manual.
The Stingray Survival Kit: Hardware + Software Methods to Detect Fake Towers covers the BladeRF and HackRF setups, the diagnostic commands for every major Android chipset, the CellMapper export workflow, and the SDR signatures for the three most common open source simulators in use today. It is the reference I wish I had when I started this work.
You can find it on my Gumroad along with my other guides on local AI, phone OSINT, and mobile privacy. The link is in my profile.
Stay aware of the signals around you. Your phone will not do it for you.
Top comments (0)