Your Phone’s Other Number

Today in Tedium: As you may know, Tedium is a blog and/or newsletter (we haven’t decided yet—I know, surprising nine years in) focused on questions that you never bothered to ask yourself, but are suddenly consumed by the second you hear them. So, here’s one such question: Where did the idea for the IMEI code come from? You likely have seen this beast of a number buried in your phone’s settings, and if you’ve ever upgraded your phone, you’ve probably run into it. So, what’s the deal—and what’s up with your IMEI code? (Is that massive number spying on you?) Today’s Tedium ponders the International Mobile Equipment Identity number, a 15-digit code that makes your phone different from any other phone on the planet. — Ernie @ Tedium

You never know when that serial number is going to come in handy. (bri hefele/Flickr)

Before we dive into IMEI numbers, let’s break down the value of serial codes

Serial numbers represent a record of how products are manufactured, sold, and distributed. They highlight important information to the manufacturer that can tell them how their product is being used in the wild.

An early example of serial codes in use dates to a May 1884 issue of The Courier-Journal, where the codes were used to identify missing whiskey barrels that were stolen from a warehouse. Odds are, consumers weren’t going to see those numbers—but the factory likely relied heavily on them.

While numbers in a serial order have likely been around since there have been numbers, there is a distinct uptick in the use of serial numbers starting in the early 20th century, based on data from a cursory Newspapers.com search. It’s something helped by the fact that there was one particular product that was not only increasingly common, but extremely complex and easy to steal: the automobile.

And yes, theft was a big reason why serial numbers became more common. As Popular Science wrote in a 1934 piece on the phenomenon, auto manufacturers used them to get ahead of auto-theft gangs of the era:

Seeking more information on how interstate gangs of auto thieves work their racket, I received new light from C.F. Cline, special agent of the National Auto Theft Bureau. This organization, supported cooperatively by the insurance companies of the country, is a powerful agency in smashing the big mobs whose underground channels move whole fleets of hot cars from state to state. Its undercover operatives, working out of key cities where central offices form clearing houses for telegraphed reports and tips, are ceaselessly active in running down interstate shipments of stolen automobiles. Each agent is a master of the scientific methods of tracing hot cars.

“A thief can no longer disguise a stolen automobile so that experts cannot identify it,” Cline told me. “Thieves usually file away the number stamped into the cylinder block and stamp a new one with dies. This ruse is useless, for when the original impression is formed. The particles of the metal beneath are pressed into a pattern which never disappears, even though the surface metal is filed away. Ordinarily, a couch of the acetylene torch will restore the original number. If not, the impression will soon respond to secret chemical processes.”

Motor manufacturers are now putting secret serial numbers at dozens of places on their cars, hidden in inaccessible spots where discovery by a thief is almost impossible. These secret codes render identification of a stolen car by an expert inevitable, and make scrambling of cars futile.

These days, serial codes are a key tool both inside the factory and outside of it. In some cases, they’re even legally mandated. The U.S. Gun Control Act of 1968, among other things, requires traceable serial codes on guns, something that has become a key element of forensic ballistics. In some circles, this is seen as controversial, as highlighted by a case involving “ghost guns” that the Supreme Court is hearing this session.

But as manufacturing has grown more complex, along with the need to source and manage materials, it was only natural that everything under the sun would get some sort of identifier, with some identifiers more important than others. As anyone who has ever used a Microsoft product can attest, the company loves its serial codes.

The Apple iMac Pro, a notable example of a device with a relatively large number of unused serial numbers. (Apple press photo)

In some cases, you can even parse the data from serial codes on sight. This gets complex at a large scale, admittedly, but examples are out there if you know where to look. For example, it’s well-known that Apple serial codes are relatively easy to understand. This can be used to a clever user’s advantage: in the Hackintoshing community, where unauthorized Intel computers are often retrofitted with a copy of MacOS to the apparent disinterest of Apple, your best option to make up a serial code is by basing it off a 2017 iMac Pro, which was a relatively low-volume product that only received one iteration. In fact, a developer I interviewed a while back, Sick Codes, developed a generator for them to take advantage of this fact. Mac serial codes, for many years, weren’t aggressively randomized, making tricks like this possible—but also having positive side effects for people down the chain, like repair shops and IT managers.

This does a great job of highlighting how serial codes can be problematic in many use cases. (May your Social Security number, a serial number that signifies your geographic area of origin and the period in which you got the card, not end up in the wrong hands.)

But serial codes also have a lot of value in other areas. If you’ve ever needed to get an appliance repaired or a part for your laptop, it’s a great way to ensure that the company is supplying parts for your exact model, not one that kinda looks like it.

The IMEI fits neatly into this trend, but not entirely in the way you think.

This boring dumbphone has more numbers than you’d guess. (wtrsnvc/Unsplash)

The IMEI is the most notable of the many serial numbers the average phone generates

A cell phone is a device defined by its numbers. First, and most obviously, there is the number people have to dial to call or text you. Then there are the serial numbers that the manufacturer uses, both as an identifier for the version of the device you own, as well as the serial number, if you ever need to call up Samsung or OnePlus to get a little support.

Then there are network identifier numbers—the MAC address bestowed upon you by your WiFi network or mobile provider, as well as the IP address you’ve been given. (Just look in your About screen; you will be impressed by the number of numbers you see.)

Diving even further, you get to more specific digits: First off, the Integrated Circuit Card Identification (ICCID) number, which is an 18 to 22-digit number intended as an identifier for your SIM card.

Next up, there’s the International Mobile Subscriber Identity (IMSI), which connects your personal identity to your SIM card. The combination of the ICCID and the IMSI basically tells the mobile network, “hey, this person paid for a plan.”

If your phone is fairly recent, you may even see a number called an EID. That number, which stands for “eSIM eUICC identifier,” is a signifier that the device has eSIM support, a replacement for the physical SIM of yore, which was removed from the iPhone in the U.S. within the last year or so.

And now, we dive into the IMEI and its related digits, which the GSMA has administered since 2000. Unlike a SIM card, it represents the identifier for the device, not the consumer. Jason Smith, the senior director for industry services at GSM Association, told me that every device with a 3GPP transceiver must include an IMEI code for regulatory reasons.

“Serving as a digital fingerprint for devices, this system brings order to what would otherwise be an unknowable mass, comprising billions of devices worldwide,” he said.

The “fingerprint” is used not only to identify the specific phone, but also the type of device it is, where it was issued, and how it’s expected to be used. And they aren’t just limited to phones. Internet of Things devices like cameras or motion sensors, for example, may also need IMEI codes.

While you can change an ICCID number by taking out your SIM and putting it into another device, the IMEI is intended to be tied to the specific device.

As this censored image highlights, IMEI numbers are located on the back of many cell phone cases. (William Hook/Flickr)

The IMEI, these days, is a 15-digit number intended specifically to classify the device as unique. The number breaks down like this:

• Issuing body: The first two digits represent the issuing body, and are based on the country-code location of the manufacturer. If your phone was made in China (as my OnePlus 11 was), it likely has an 86 up front, matching China’s country calling code. If it was built internationally (say, an iPhone or Google Pixel device), it will generally start with a 35, which is unused as a country calling code. And if it was physically built in the Americas, it starts with an 01, also matching its country calling code.
• Type Allocation Code: The next six digits in modern phones are treated as specific identifiers for the type of device you’re using, representing the serial code for the device model. Despite the sheer number of gadgets being made each year, Smith says “we have not seen a massive increase in TAC being allocated.”
• Serial code: The next six digits represent the exact device you’re using. As you may have determined by the use of math, each TAC number supports a million IMEI, says Smith. “We are seeing an increase in the volume of devices being sold, but not an increase in the number of models, meaning that TAC is now being more efficiently used,” he explained. “The same IoT model typically has more than one TAC as they make several million all the same.”
• Check digit: The final digit is essentially used to validate the prior 14 digits with an algorithm. Similar digits exist in other types of identifier codes, such as the Universal Product Code (UPC) and the International Standard Book Number (ISBN). The algorithm that the mobile industry uses, the Luhn algorithm, is also used for social security numbers and credit card numbers.

These numbers, which are required because of European regulations that date back to the 1990s, serve many roles for manufacturers, says Smith.

“The extensive device attribute data empowers business with improved operational metrics and advanced analytics,” he says. “This, in turn, ensures smoother rollouts of new technologies and upgrades, along with real-time adjustments for enhanced capacity planning.”

In layman’s terms, that means better customer support, better supply chain tracking, and smarter marketing opportunities. But it also carries public-safety benefits—benefits that come in handy, if, say, your phone gets lost or stolen.

If you’ve ever wondered what it was like to have your phone stolen, here you go. (Kai Hendry/Flickr)

Was the IMEI number designed to prevent theft? No, but it admittedly helps

Imagine, if you will, it is the early 1990s. The cell phone is a luxury that costs hundreds of dollars and requires a service contract. They are uncommon for the average person to have, and they don’t do that much. But their high cost and relatively novel nature makes them a target. That creates a big problem for both the public and the budding industry. Compare the problem to say, car stereos, except odds are you might actually carry the expensive electronic device on your person.

During the first days of the cellular phone in the 1980s, news stories strongly focused on theft, in part because these devices were expensive and potentially dangerous in the wrong hands.

Early on, cell phone networks kept their own databases of phones, which they could then use to disable a device that shouldn’t be on the network. One mobile phone retailer quoted in a 1987 McClatchy News Service story put the issue this way: “Professional thieves know about this—that a stolen cellular phone won’t do them any good. But, amateurs will try it (theft) anyway.”

But as the mobile phone industry blew up, these early claims of theft impossibility gradually rang hollow as thieves grew more sophisticated. By the late 1990s, a story reminiscent of an episode of The Wire appeared on the front page of The Baltimore Sun with a direct headline that suggested the wireless employee quoted above was wrong: “Balto. Criminals want your phone number.”

The story implied that cell phones were leading to other forms of crime, such as smashed-in car windows, and had become a key element of the criminal underworld. “The outbreak is fueled by a high-tech $600 million criminal industry that has turned a hot commodity of the ’90s into a tool of the drug trade,” the piece stated. “Stolen phones—quickly reprogrammed with pilfered numbers—are eagerly sought by drug dealers.”

(I checked; David Simon did not write the story.)

One would presume the IMEI code was developed to fight crime—something implied by the first news article I could find discussing the codes for a mainstream audience, published in 1999 by the Sydney Morning Herald—but not so, Smith.

“The primary driver was to uniquely identify a mobile device on the network and show regulatory approval in Europe, and it naturally became a method for operators to identify devices on their network via the TAC,” Smith explained. “For years, the IMEI number has been used to identify each and every device on a mobile operator’s network.”

It was quickly used for this exact reason, however. A 2001 InfoWorld article described how the Amsterdam police force had begun using an aggressive texting strategy whenever a cell phone was reported stolen. Every three minutes, they’d send the stolen phone this message: “This handset was nicked, buying or selling is a crime. The police.”

(Great message, must say.)

Smith says this use case, while not the primary intent, became essential over time, giving both mobile networks and police departments tools to minimize the impact of stolen phones on the network.

“The IMEI can be blocked on a mobile network, which then disables it to work on that network,” he explained. “The GSMA has a central register where operators can exchange the blocked IMEI.”

That database is one that mobile providers, recyclers, and retailers can use to ensure stolen phones don’t enter the network or get resold.

What’s it like when a phone gets sold with an IMEI lock on it? You can actually see this in action if you search for “bad IMEI” on eBay. Phones will show up there with their IMEIs disabled from accessing a mobile network, a sign that the phones have been lost or stolen, which deeply impacts their functionality. (Which means, if you want to buy a used phone, ensure it has a “clean IMEI.”)

But as Smith notes, the criminal issues that follow smartphones extend well beyond some guy trying to snatch your phone out of your pocket.

“Today, it is not just phone theft that needs to be tackled, but also subscription fraud, insurance fraud, smuggling and the production of counterfeit phones, which have a negative impact on consumers who risk lower quality, safety, security, and environmental health and privacy assurances,” he explained.