Fake cell towers called stingrays can trick your phone into handing over its location

A mobile phone is built to trust the strongest cell signal nearby, and that reflex is exactly what a class of surveillance devices known as stingrays exploits. Also called cell-site simulators or IMSI-catchers, these suitcase-sized tools masquerade as legitimate cell towers, luring nearby phones into connecting so their operators can pinpoint a device’s location and, in some configurations, learn more about who is using it. The technology has spread from federal agencies to local police and, increasingly, to criminals and foreign operatives.

How a fake tower fools a phone

Phones are designed to latch onto whichever tower offers the best signal, with no way for the user to confirm that the tower is real. The Electronic Frontier Foundation explains that a cell-site simulator impersonates a cell tower, broadcasting a strong signal that convinces phones in range to connect to it instead of the genuine network. Once a phone connects, the device sits between the handset and the real network.

From that position, the simulator can capture the identifiers a phone transmits, including the International Mobile Subscriber Identity, or IMSI, a unique number tied to the SIM that gives the class of devices its other name, IMSI-catchers. Because the connection happens automatically and silently, the phone’s owner typically has no indication that anything unusual has occurred.

Tracking a device to a person

The primary capability is location. By measuring the signal strength between a phone and the simulator, an operator can determine which devices are present in an area and follow a specific handset as it moves, effectively tracking the person carrying it. Investigators have used this to place a suspect at a scene or trace a phone through a building.

Range and precision vary with the equipment. Some simulators are stationary units operated from a vehicle, while others are small enough to be carried by hand, and by moving the device or comparing signal readings an operator can narrow a target’s position from a general area down to a specific room. That capability is what makes the tools valuable for surveillance and, in the wrong hands, for stalking or targeting a particular individual.

Some simulators reach further than location alone. Depending on the model and how it is configured, a device may be able to intercept metadata about calls and texts, and certain older or more aggressive setups can degrade a phone’s connection to a less secure network standard, opening the door to capturing additional information. The exact reach varies widely with the hardware and the network involved.

From federal use to a widening circle of operators

Cell-site simulators were long associated with federal law enforcement and intelligence work, but their use has broadened. State and local police departments have acquired the technology, often under strict secrecy, prompting civil-liberties groups to warn that the devices sweep up data from every phone in range, not just those of investigative targets, raising questions under laws meant to protect against unreasonable searches.

The concern no longer stops with government. As the equipment has grown more accessible, security researchers and officials have cautioned that criminals and foreign operatives can deploy simulators too, using them to locate individuals or to probe the phones of people gathered at a particular place. That diffusion turns what was once a specialized surveillance tool into a more general privacy threat.

Documented deployments have ranged from criminal investigations to the monitoring of protests and public gatherings, uses that critics say sweep in the phones of bystanders who are neither suspects nor aware they are being tracked. The secrecy that has surrounded government purchases of the devices has made independent oversight difficult, fueling calls for clearer disclosure.

Why the technology is hard to detect

Part of what makes cell-site simulators effective is their invisibility to ordinary users. A phone gives no alert when it connects to a fake tower, and the interaction can be brief, leaving no obvious trace on the device. The bulk collection of nearby phones’ identifiers also means bystanders can be caught up without any suspicion attaching to them.

This opacity has fueled a long-running debate over oversight and disclosure. Advocacy organizations have pressed for warrant requirements, public transparency about when and how the devices are used, and limits on retaining data collected from uninvolved phones, arguing that a tool capable of tracking anyone with a phone demands clear legal guardrails.

What phone owners can do to reduce exposure

Individual defenses against cell-site simulators are limited, but not nonexistent. Because the devices exploit the cellular network itself, using applications that rely on end-to-end encryption for calls and messages protects the contents of communications even if a simulator captures the connection, since the interception yields scrambled data rather than readable conversations.

Keeping a phone’s software updated helps as well, since carriers and manufacturers have worked to make handsets more resistant to being forced onto weaker, less secure network standards. For those most concerned about tracking, the surest safeguard remains the bluntest one: a phone that is powered off or left behind cannot be located by a simulator, a trade-off between convenience and privacy that each person weighs differently.

For most people the practical risk from a cell-site simulator remains low, but the same defenses that guard against other forms of interception offer the best available protection: encrypted messaging and calling apps, current device software, and an awareness of when a phone unexpectedly drops to an older, less secure network standard.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview