SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone

SS7 and Diameter signaling attacks can track, intercept, and impersonate you. Here’s how they work and how to stop them.

Your phone can be tracked, your SMS two-factor codes can be intercepted, and your number can be impersonated, all without malware, a phishing link, or any access to your device.

The attacks happen inside the telecom network, in the carrier-to-carrier control protocols known as signaling, the automated descendants of the old telephone switchboard. Most users never see them, and most carriers can’t reliably stop them.

Signaling attacks aren’t new. Most recently, they made headlines when Iranian-linked actors reportedly exploited outdated network technology to locate the phones of US personnel in the Middle East during the Iran war.

But the vulnerability has been around for decades, and it’s been used for far more everyday crimes, like intercepting bank one-time passcodes. It has even been demonstrated by popular YouTubers: Veritasium hijacked a tech influencer’s calls and texts using only his phone number.

This keeps happening

• Criminals have reportedly exploited signaling protocols in attacks on

  bank accountsand global telecom infrastructure.

• Citizen Lab exposed

  two long-running commercial surveillance campaignsabusing SS7 and Diameter, with thousands of attacks against targets in dozens of countries.

• Congressman Ted Lieu’s phone was hacked on live TVvia SS7 on 60 Minutes Australia

• Attackers have

  intercepted SMS one-time passcodesto drain victims’ bank accounts.

What is a signaling attack?

Every call, text, and mobile data session requires your carrier to verify you’re a paying customer and route your traffic to the right destination.

Carriers do this with signaling–background messages that identify your location and forward traffic accordingly. Signaling has been the connective tissue between global providers for decades, and it is one of the most overlooked attack surfaces in mobile security.

Two protocols do most of the work: SS7 (from the 1970s, used in 2G/3G) and Diameter (its successor, used in 4G and most 5G).

Both were designed when a small number of large operators could plug into the system, so they assume that traffic claiming to come from a legitimate operator really does. SS7 has essentially no process for authenticating the machine making a request.

Diameter supports stronger authentication on paper, but operators don’t always deploy basic protections like encryption, and many fall back on the same peer-to-peer trust model.

An attacker with access to the global signaling backbone, through a commercial leasing arrangement or a compromised operator, can send messages that carriers worldwide treat as trustworthy.

How does it work

Signaling lets an attacker ask your carrier questions and make claims on your behalf:

• Harvest your IMSI.Knowing your number, an attacker can request your International Mobile Subscriber ID (IMSI) under the pretense of routing a call or SMS. It can be reused for follow-on attacks for years.
• Locate you in real time.Queries can return the cell tower you last connected to. Others, normally reserved for emergency responders, can return the actual coordinates your phone reports.
• Intercept communications.The attacker claims you’ve roamed onto another network, so your calls and texts are redirected to them. Combined with a stolen username and password, this delivers your SMS second factor to the attacker instead of you.
• Impersonate or block you.With your IMSI, an attacker can place calls or send SMS as you. A false roaming claim can also cut off service to your phone.
• Disrupt networks.Deliberately misconfigured signaling messages can overwhelm provider systems.

None of this touches your device. It happens in automated transactions you can’t see and that leave no trace on your phone.

Why firewalls and velocity checks fall short

Carrier signaling firewalls reliably block messages sent to or from the wrong place. For correctly routed messages, they often run a velocity check to test whether you could physically have traveled from your last known location to the one now claimed. If you were in New York an hour ago and a Turkish carrier says you’re on its network, the request is denied.

The structural problem is that the firewall’s location data is often hours old. In research presented at the Wireless Security conference in 2025, Cape, the privacy-first mobile carrier, measured Diameter updates from a visited network arriving as infrequently as every two to ten hours.

For subscribers in the US and Germany, over 250 distinct networks are reachable within a single hour of travel time. An attacker with enough operator identities will eventually find one that looks plausible.

Citizen Lab’s report shows this in practice: the actor it calls STA1 repeatedly tried to track a user by rotating through eleven operator identities in nine countries to look like legitimate roaming traffic. They also pivoted between SS7 and Diameter, which most carriers defend with separate firewalls and little coordination.

Consider a target who boards a flight from Nashville to Berlin and powers off her phone. A message posing as China Mobile claiming she’s roaming there gets rejected, because it’s physically impossible.

A message from a carrier in nearby Nassau, Bahamas, looks plausible, and the home carrier can be fooled into routing her calls and SMS to the attacker.

Protect yourself with private cell service.

Cape is America’s privacy-first mobile carrier providing unlimited talk, text, and 4G/5G data, built from the ground up with privacy and security at it’s core.

Most carriers track everything: where you go, who you call, what you do. Cape collects the minimum amount of information required to provide you with service, deletes call and text metadata after 24 hours, rotates your network ID to prevent tracking, defends against SIM- and network-based attacks, and more.

Privacy shouldn’t cost more. Switch today and get $29 off for life.

Learn More →

How Cape defends against signaling attacks

Cape is a privacy-first mobile carrier, whose approach is to assume the global telecom system is compromised and build protections that keep communications private anyway. There are four layers:

1. Daily IMSI rotation. Almost every targeted signaling attack starts with an IMSI, and once an attacker has yours, it stays useful for as long as you have it. A Citizen Lab report confirms this, with the same IMSIs being attacked across operations separated by months and years. On most carriers, your IMSI is permanent. You get one when you activate your SIM and you keep it forever. On Cape, your IMSI rotates daily. The databases of harvested IMSIs that surveillance vendors build up over the years are no longer useful against Cape subscribers.

2. No SS7. Cape doesn’t support SS7 at all, and there is no SS7 fallback in the network, so SS7-based attacks have nothing to land on. Many carriers still struggle to retire legacy SS7 infrastructure because some revenue-generating part of their network depends on it. 

3. Network Lock. Instead of trusting a network’s idea of where you are, Cape asks your device. When a foreign network requests to attach to your phone, Network Lock queries the Cape app, which evaluates the claim locally at the country level and reports back whether it matches. If an attacker tries to attach your IMSI from another country while your phone is at home, the request is denied and you’re notified. Cape’s systems learn only whether the claim matches, not where you actually are, and Cape never collects or stores your precise location.

4. Continuous penetration testing. Most signaling firewalls are compliance tools tuned to GSMA baseline recommendations. Those recommendations are distributed to more than 1,200 member providers, so the same guidance is available to attackers who can send signaling messages. Cape has third-party firms that specialize in current signaling exploitation techniques to test its infrastructure, then hardens the network against what they find, especially anything affecting subscriber privacy.

You can’t patch the telecom backbone, but you can choose your carrier

Following every best practice, such as using encrypted messaging, avoiding public Wi-Fi, and enabling 2FA, still leaves your device dependent on networks never built with security in mind.

For people who are targeted, such as journalists, executives, security staff, and anyone whose accounts rely on SMS verification, the carrier is part of the threat model.

Switch to a carrier built for signaling security. Learn more about Cape →

Sponsored and written by Cape.