Researchers at Michigan State University and three partner schools bought a Samsung Galaxy Z Fold 7, copied the identification number printed on the sealed box, and reported the phone to its carrier as lost. Then they opened the box and set the phone up the way a launch-day buyer would. It would not connect. The phone was new, unopened, and sitting on a lab bench the entire time.
The team found six weaknesses in the system carriers use to shut off lost and stolen phones, spanning the devices themselves, the carrier systems that take the reports, and the machinery carriers use to share block lists. They ran the tests on three major U.S. carriers and their resellers. Blocking a device they did not own cost between $2.50 and $4 and took between about 20 and 80 seconds. The target does not have to be a phone. It can be the alarm panel in a house.
End-to-end lost/stolen device reporting ecosystem across device, carrier, and cross-carrier domains, with vulnerabilities shown at their exposed points (Source: Research paper)
What gets blocked and how
Every device with a cellular radio carries a 15-digit serial number called an IMEI, burned in at the factory and separate from the SIM card, the phone number and the account. When you report a phone stolen, the carrier drops that number into a database called an Equipment Identity Register. After that, the network refuses to register the device. It does not matter who is holding it or which SIM is inside.
That is the correct behavior for a stolen phone. What the researchers went looking for is what stops someone from typing in a number that is not theirs. Guan-Hua Tu, an associate professor in Michigan State’s College of Engineering, said an attacker can use the weaknesses to cut a device off remotely, “even though the device has not actually been lost, stolen or sold.”
The identity checks are thin
The three carriers accept reports only from people with active service, which is supposed to make reporters traceable. The team opened accounts on all three carriers to see how much traceability that buys. None of the three verified a Social Security number or a government ID when setting up a prepaid account, and prepaid customers could file lost-device reports the same as anyone else. Prepaid service can be paid for with an anonymous Visa gift card bought off a rack at Walmart.
The second check is ownership, and carriers approximate it by looking at whether the device has been active on the account. The check does not establish who owns a device. It establishes that the device has spent some time on the network, which is a different thing, and a spoofed device can produce that history on demand. On one carrier, one second of attachment was enough. The other two wanted a minute. After that minimum, none of the three asked for any calls or any data at all before letting the researchers report a phone they had never used.
The third gap is what counts as a reportable device. The team submitted reports for a smartwatch, for cellular development boards used in industrial equipment, and for a phone that physically cannot operate on the carrier’s frequencies. All of them went through, on all three carriers, from an ordinary smartphone plan with no IoT subscription attached. Once reported, the devices could not get back on.
Pulling this off requires knowing the target’s IMEI, which is where the two demonstration attacks come in.
The alarm panel goes quiet and the homeowner is not told
Home security gateways usually run on Wi-Fi and keep a cellular link as backup, and to keep that backup cheap they use low-power cellular chips built for connected devices. The researchers tested four such boards alongside four phones, feeding each one a deliberately corrupted request for its identity. The phones ignored it, as the standard requires. Two of the boards answered with their IMEIs. Both were vulnerable because of the chipset inside, and those chipsets come from two vendors whose combined global share of that market is above 40 percent.
The attack built on that runs in two parts, and the parts can be months apart. First, knock the gateway off Wi-Fi so it falls back to cellular, stand up a small rogue base station to lure it in, and ask for its IMEI. In the lab this took 17 seconds, after which the base station gets switched off and leaves nothing for the carrier to detect. Later, disrupt the Wi-Fi again and file the lost-device report. The gateway drops to cellular the way it is designed to, about 15 seconds after the Wi-Fi cuts out, and finds the network will not take it. Alarms stop reaching the homeowner and the monitoring center.
The researchers bought a gateway from one of the two largest U.S. alarm providers, paid for its monitoring service, and confirmed all of this end to end. The other large provider uses the same vulnerable chipsets. Together the two hold more than 41 percent of the U.S. market. The same chips also sit inside water and electricity meters, industrial sensors and cardiac monitors, though the team did not test those devices.
Blocking phones that have not been sold yet
The second attack goes after new flagship handsets. IMEIs are assigned before a phone ships, and companies that verify devices for the supply chain can buy access to them. The team paid $600 for a full database from one such company, plus $30 a month for updates, and found the Z Fold 7’s number listed before the phone’s July 25, 2025 release.
A single prepaid account reported ten devices without tripping anything. Per device, the block cost $2.50, $3.50 or $4 depending on the carrier. Blocking 100 Z Fold 7s would take ten prepaid accounts, $250 to $400, and somewhere between 33 minutes and a little over two hours, against $200,000 worth of phones. The team wrote a script to drive the carriers’ web forms and did not bother optimizing it.
Victims get no notice that any of this has happened. Service simply stops. Getting it back means proving to the carrier that you own the device, usually with a receipt showing the IMEI plus identity verification, and if the fraudulent report came in through a different carrier the request can escalate to the GSMA, the industry body that runs the global block list, which adds more delay.
One more finding cuts the other way, and it is not reassuring either. A phone reported lost on one carrier still worked fine on the other two a week later, which means at least two of the three are not syncing with the global list they tell customers about.
The proposed fixes
The team put forward four changes and built a working prototype of them. Device certification tests should check that a phone or module keeps its IMEI to itself when a request arrives unauthenticated, which is the gap that let those two boards leak. Reporting portals should run reporters through government-ID verification, using the same third-party services that federal agencies already use.
Ownership checks should combine several signals, including whether the device matches the reporter’s plan, and send anything doubtful to an in-store visit. And the records carriers pass to each other should carry the security details they currently omit, such as whether the reporter was ever identity-checked, so a receiving carrier can decide whether to trust a block.
The researchers notified the affected carriers, chipset vendors and manufacturers. The GSMA acknowledged the findings and passed them to its device security group. Tu has said the aim is to raise the cost of an attack while leaving the process alone for people who really have lost a phone.
Download report: How security controls perform in practice
