Cell site simulators and silent SMS: what your phone tells the network

Your phone is face down on the desk. Location services are off, no app is running, and the network still knows roughly where it is. That is how cellular service works: to receive a call, your phone has to be registered with a tower nearby. A cell site simulator turns that basic fact into a surveillance tool. It plays the role of a tower. Every phone in range that connects to it gives up a little information about itself.

You have probably heard these devices called Stingrays. This guide explains what they collect and what they do not, how the lesser known silent SMS fits in, what the Justice Department allows its own agents to do, and which settings on your phone make a real difference. Spoiler: it is fewer than the detector app ads suggest.

What a cell site simulator does

Every SIM card carries a unique identifier called the IMSI, the International Mobile Subscriber Identity. When a phone connects to a tower, it introduces itself with identifiers like this one. A cell site simulator, also known as an IMSI catcher, broadcasts as if it were a legitimate tower, often with a stronger signal than the real ones. Phones in range switch over. Then they introduce themselves to it instead.

That gives the operator two capabilities. Police can figure out which phone a suspect is actually carrying, for instance after a phone has been swapped. Or they can take a phone they already know and narrow down where it is, by following the signal as it gets stronger. The Justice Department describes what its devices get as relative signal strength and general direction. They are not GPS trackers, and they do not read location data from apps.

Why do phones fall for it? Part of the answer is old technology. In a 2023 post on its security blog, Google explains that 2G networks based on the GSM standard lack mutual authentication. The phone proves who it is to the network. The network never proves anything back. Simulators exploit this by forcing phones to downgrade from 4G or 5G to 2G, and Google calls that downgrade the most common way these devices are used.

The Electronic Frontier Foundation, the digital rights group that tracks this technology closely, separates two kinds of device. Passive IMSI catchers only listen. Active cell site simulators transmit, and those are the ones law enforcement uses most. The EFF also notes that active devices can disrupt cell service within a radius of up to 500 meters, which can include emergency calls.

Who gets swept up

Here is the uncomfortable part. A simulator cannot pick and choose. It has no way to ask only the suspect’s phone to connect. Every phone within range that latches onto the fake tower is logged, whether it belongs to the target, a neighbor, a delivery driver or someone sitting in the coffee shop downstairs. The EFF argues that this amounts to a general search of everyone nearby.

Protests show the problem clearly. In August 2024, Wired reporters carried phones and mobile hotspots running EFF detection software around the Democratic National Convention in Chicago. Months later, EFF technologists reanalyzed that raw data with a new detection method. They found that on August 18, a reporter’s device near a hotel housing Midwestern delegates abruptly switched to a new tower that asked for its IMSI, a pattern the EFF had otherwise only seen in controlled test attacks. The Chicago Police Department told Wired it did not deploy a cell site simulator during the convention. The Secret Service said it does not discuss its methods for such events. Who operated the device, if it was one, remains open.

That matters beyond one convention. A crowd at a protest is exactly the kind of place where many phones sit close together, and where people have good reasons not to want a record of their attendance. Lawyers, reporters and medics are in that crowd too. The device does not know who they are. It just logs them.

Silent SMS: location without a fake tower

There is a quieter way to find a phone, and it does not need any hardware near the target. The 3GPP standard defines a message type called Short Message Type 0. A phone that receives one has to acknowledge it to the network, discard the content and show the user nothing. No sound, no notification, no entry in your messages. It even gets through when the phone’s storage is full.

The content is irrelevant. What matters is that the phone has to respond. The carrier then logs which cell handled the delivery. Investigators can then get that record from the carrier. Send a series of these and you have a rough trail of where the phone has been. A report by the German parliament’s research service from 2012 cites literature describing one message every 15 minutes at most.

Two things about silent SMS are commonly misunderstood. It cannot be used to listen in. It cannot read anything either. And the location is only as precise as the cell network around you. That same German report gives about 500 meters as a typical figure, sometimes down to 50 meters in dense city centers and around 5,000 meters in rural areas.

Stingray, silent SMS and tower dumps compared

These terms get mixed up a lot, and so does a third one, the tower dump. They differ in who supplies the data and how many people end up in it.

A tower dump looks backward. Investigators ask the carrier which numbers were connected to a specific tower at a specific time, for example near a crime scene, and they get every one of them, including people who had nothing to do with it.

The rules federal agents follow

In September 2015, the Justice Department published a policy for its own agencies, the federal law enforcement components that include the FBI. It is one of the few official documents that lays out what these devices may be used for, and it is still the baseline people point to.

Two caveats matter. This is internal policy rather than a statute. It binds federal agencies under the Justice Department and nobody else. State and local police set their own rules. The EFF notes that some states, California among them, require a warrant except in emergencies, while practice elsewhere varies. If you want to know whether your local police own such a device, the EFF’s Atlas of Surveillance, a public database of police surveillance technology, is a reasonable place to start.

Can you detect a Stingray?

Honestly, not reliably. Passive IMSI catchers send nothing. The EFF says it is impossible for anyone to know whether their phone’s signals were picked up by one. Active devices are easier in theory. Typical signs include a sudden drop to 2G for no obvious reason, or a tower that asks for the phone’s IMSI in a way normal towers rarely do.

The trouble is that ordinary phones do not show you any of this, and the apps that promised to are a mixed bag. The best known, SnoopSnitch from the Berlin-based Security Research Labs, needed a rooted Android phone with a Qualcomm chip for its network features, and its Play Store listing was last updated on October 28, 2023. The EFF writes that apps of this kind “may not be verifiably accurate.”

That gap is why the EFF released Rayhunter in March 2025, an open source project that runs on a cheap mobile hotspot instead of your phone. It records traffic between device and tower. Suspicious events get flagged, such as a downgrade request to 2G. The EFF’s goal is research: collecting enough data to learn where and how these devices are actually used. The Chicago analysis above came out of exactly that kind of data. It is a measuring stick. It does not stop anything.

And if your status bar briefly shows 2G or “E”? Usually that is a weak signal on a train or an overloaded tower at a concert, not a Stingray.

Phone settings that actually help

No setting blocks a silent SMS while your phone is on the network, and nothing on your phone stops a tower dump. Against the fake tower trick, a few settings do real work.

Google added the 2G switch in Android 12, starting with the Pixel 6. It is now available on Android phones whose radio layer supports the required interface version, and Google says emergency calls still work with 2G off. Android 14 added an option for companies and agencies to lock 2G off on managed devices. Where the toggle lives depends on your phone maker, so search your settings for “2G”.

On iPhone, there is no standalone 2G switch. Lockdown Mode turns off 2G and 3G, but Apple describes the mode itself as an extreme protection for the very few people who might be personally targeted because of who they are or what they do. If you are a journalist covering protests or an activist, that may be you. For everyone else, the tradeoffs in daily use are steep.

If you want the bigger picture of what your phone reveals through apps rather than the network, our guide on how to stop sharing your location covers the app side, which is often more precise than any cell tower. And if you think hiding your caller ID changes what your carrier records, the article on calling anonymously explains why it does not.

The short version

A cell site simulator works because your phone wants to be reachable and trusts whatever tower sounds strongest. A silent SMS works because the carrier logs every delivery. Neither reads your messages under normal rules, and both reveal where you are.

For most people, this is not a daily risk. Under the DOJ rules above, federal use is tied to warrants and specific targets, and data from bystanders is supposed to be deleted on a fixed schedule, daily when locating a known phone and at least every 30 days otherwise. The realistic steps are short: switch off 2G if your phone allows it, keep sensitive conversations in end-to-end encrypted apps, and treat detector apps with healthy suspicion. If you are heading into a situation where your location really matters, powering the phone off is still the only thing that reliably keeps it off the network map. Thinking about who might want your data in the first place is half the job, and our piece on OPSEC helps with that part.

Frequently asked questions

What is a Stingray device?

Stingray is the name of one well-known product that became shorthand for the whole category, which is officially called a cell site simulator or IMSI catcher. The device pretends to be a cell tower. Phones nearby connect to it and reveal identifiers such as the number stored on the SIM card, which lets the operator figure out which phone a suspect is carrying or where a known phone is located.

Can a cell site simulator read my texts or listen to calls?

The Justice Department says the devices its agencies use must be configured so they do not collect the content of any communication, and they do not pull emails, texts, contacts or photos from the phone. That is a policy for federal agencies, not a technical limit. The EFF points out that if a simulator forces a phone onto an old 2G connection, intercepting unencrypted calls and texts becomes possible in principle. End-to-end encrypted apps such as Signal protect content either way.

How can I tell if a Stingray is near me?

On an ordinary phone, you mostly cannot. Passive IMSI catchers only listen and, according to the EFF, are impossible to detect. Active ones leave traces, like an unexplained drop to 2G or a tower that keeps asking for your SIM identity, but those traces also have harmless causes. Detector apps have a poor track record. The EFF built an open source research tool called Rayhunter to log such anomalies, and even it is meant for gathering evidence, not for shielding a phone.

What is a silent SMS?

A text message your phone receives but never shows you. In the mobile standard it is called a Type 0 message: the phone confirms delivery to the network and throws the content away. The point is the delivery itself, which forces the phone to check in and creates a record at the carrier showing which cell it is connected to. It reveals location, not content.

Does turning off 2G protect against Stingrays?

It closes the most common door. Many simulators push phones down to 2G, where the phone has no way to verify that the tower is real. Android 12 and later lets you switch 2G off on supported phones, and on iPhone, Lockdown Mode disables 2G and 3G. It does not stop every technique, and it does nothing against location requests that go to your carrier.

Do police need a warrant to use a cell site simulator?

For Justice Department agencies such as the FBI, a 2015 policy requires a search warrant in most cases, with exceptions for emergencies and a narrow set of exceptional circumstances. State and local police follow their own state rules, and those differ. Some states, California for example, require a warrant except in emergencies.