Location tracking, SMS interception, and number spoofing are all possible through the telecom network's signaling layer—the automated protocols that route calls and texts between carriers. These attacks require no malware, no phishing, and no access to your phone. They operate invisibly within infrastructure most users never see and that most carriers struggle to defend.
Signaling attacks have surfaced repeatedly in recent years. Iranian-linked actors reportedly used outdated network technology to locate US personnel phones in the Middle East. Citizen Lab documented two sustained commercial surveillance campaigns exploiting SS7 and Diameter protocols, involving thousands of attacks across dozens of countries. Congressman Ted Lieu's phone was compromised on live television via SS7 during a 60 Minutes Australia segment. Criminals have drained bank accounts by intercepting one-time passcodes, and popular YouTubers have demonstrated the technique publicly—Veritasium hijacked a tech influencer's calls and texts using only a phone number.
How signaling attacks work
Carriers use signaling—background messages that verify customer status and route traffic—to manage every call, text, and data session. Two protocols handle most of this work: SS7, deployed since the 1970s for 2G and 3G networks, and Diameter, its successor used in 4G and most 5G deployments. Both were designed when only a handful of large operators existed, so they trust traffic claiming to originate from legitimate operators without robust authentication. SS7 has virtually no authentication mechanism. Diameter supports stronger authentication theoretically, but operators frequently omit basic protections like encryption and rely on the same peer-to-peer trust model.
An attacker with access to the global signaling backbone—through a commercial leasing arrangement or a compromised operator—can send messages that carriers worldwide accept as legitimate.
Signaling enables attackers to:
- Extract your International Mobile Subscriber ID (IMSI) by requesting it under the guise of routing a call or SMS; this identifier remains useful for years of follow-on attacks
- Pinpoint your location in real time by querying the cell tower you last connected to, or in some cases obtain actual coordinates your phone reports
- Redirect your calls and texts by claiming you've roamed onto another network, then intercept them; combined with stolen credentials, this diverts your SMS second factor to the attacker
- Impersonate you or block your service by using your IMSI to place calls and send SMS in your name, or by falsely claiming roaming status to cut off service
- Overwhelm carrier systems with deliberately misconfigured signaling messages
None of these attacks touch your device. They unfold in automated transactions invisible to you and leave no trace on your phone.
Why carrier defenses fall short
Carrier signaling firewalls effectively block messages from incorrect sources. For legitimately routed messages, they typically perform velocity checks—testing whether you could physically have traveled from your last known location to the one now claimed. A request claiming you're in Turkey an hour after being in New York would be rejected.
The critical weakness is that firewall location data is often hours outdated. Research presented at the 2025 Wireless Security conference by Cape, a privacy-focused mobile carrier, found that Diameter updates from visited networks arrive as infrequently as every two to ten hours. Within a single hour of travel time, over 250 distinct networks are reachable in the US and Germany. An attacker controlling multiple operator identities will eventually find one that appears plausible.
Citizen Lab's research demonstrates this in practice. The actor designated STA1 repeatedly attempted to track a user by cycling through eleven operator identities across nine countries to simulate legitimate roaming. The same actors switched between SS7 and Diameter, which most carriers defend with separate firewalls and minimal coordination.
Consider a scenario: a user boards a flight from Nashville to Berlin and turns off her phone. A message claiming she's roaming on China Mobile gets rejected as physically impossible. But a message from a carrier in Nassau, Bahamas—geographically plausible—can fool her home carrier into routing calls and SMS to the attacker.
Defensive approaches: the Cape model
Cape operates as a privacy-first carrier that assumes the global telecom system is compromised and builds protections that maintain communication privacy regardless. The carrier deploys four defensive layers:
- Daily IMSI rotation. Most targeted signaling attacks begin by harvesting an IMSI, which remains valuable indefinitely on conventional carriers. Citizen Lab confirmed that the same IMSIs are attacked across operations separated by months and years. Standard carriers assign one IMSI at SIM activation and never change it. Cape rotates the IMSI daily, rendering surveillance vendors' accumulated IMSI databases useless against its subscribers.
- No SS7 support. Cape does not support SS7 and maintains no SS7 fallback in its network, eliminating SS7-based attack vectors entirely. Many carriers struggle to retire legacy SS7 infrastructure because revenue-generating network components still depend on it.
- Network Lock. Rather than trusting a network's location claims, Cape queries the subscriber's device. When a foreign network requests to attach to a phone, Network Lock queries the Cape app, which evaluates the claim locally at the country level and reports back whether it matches. If an attacker attempts to attach an IMSI from another country while the phone is at home, the request is denied and the user receives notification. Cape's systems learn only whether the claim matches, never the actual location, and Cape does not collect or store precise location data.
- Continuous penetration testing. Most signaling firewalls function as compliance tools calibrated to GSMA baseline recommendations. Those same recommendations are distributed to over 1,200 member providers, making them available to attackers capable of sending signaling messages. Cape engages third-party firms specializing in current signaling exploitation techniques to test its infrastructure and harden the network against discovered vulnerabilities, particularly those affecting subscriber privacy.
The carrier as part of the threat model
Following every security best practice—using encrypted messaging, avoiding public Wi-Fi, enabling two-factor authentication—still leaves your device dependent on networks designed without security in mind. For targeted individuals such as journalists, executives, security personnel, and anyone whose accounts rely on SMS verification, the choice of carrier becomes part of the threat model. Switching to a carrier built specifically for signaling security represents a concrete mitigation option.