Security · 2026-07-31

Roaming Steering and Identity: When the HPLMN You Trust Hands You to a VPLMN You Don't

By J. W. Bouckaert

The signal was never just about the subscriber

Every carrier-derived identity signal carries an implicit second subject. The stated subject is the subscriber: has this SIM been swapped, has this number been ported, is this device where it claims to be. The unstated subject is the network that answered the question.

Domestically, the two collapse into one. The home network holds the subscription, holds the authentication vectors, holds the SIM change timestamp, and answers the query directly. There is exactly one operator in the trust chain, and it is the one with the contractual relationship to the subscriber.

The moment the subscriber roams, the chain lengthens. A visited network now performs the radio-layer authentication run, observes the location updates, terminates the signalling that a fraud attempt would exploit, and in many configurations sits between the home network and the truth. And the choice of which visited network is made, in large part, by the home operator rather than the subscriber, through Steering of Roaming, and constrained by a document most identity engineers have never read: GSMA IR.21.

That is the uncomfortable shape of the problem. The operator you trust selects, on your behalf and for its own commercial reasons, the operator you have never assessed.

PLMN selection

The mechanics matter here, because most of the risk sits in details that are usually skipped.

When a UE loses its home network, 3GPP TS 23.122 governs network selection. In automatic mode the UE walks an ordered set of lists held on the USIM, defined in 3GPP TS 31.102:

The ordering is what makes steering possible: the user-controlled list is consulted ahead of the operator-controlled one, but in practice most subscribers never populate it, so the operator-controlled list is decisive. A home operator that wants its subscribers on Partner A rather than Partner B updates EF_OPLMNwACT over the air and the handsets comply on the next selection cycle.

In 5G standalone the steering channel became a first-class, integrity-protected NAS feature. Under 3GPP TS 23.501 and TS 24.501, the home network's Steering of Roaming Application Function delivers an SoR container inside the Registration Accept message, protected by an SoR-MAC-I derived at the AUSF. The UE verifies the MAC before acting on the list. This is a genuine security improvement over the legacy path, and it is worth being precise about what it protects: it protects the integrity of the steering instruction, not the security posture of the network being steered to.

Legacy steering was cruder and is still in wide use on 4G and earlier. Two techniques dominate:

1. OTA list updates. The home operator rewrites the preferred-PLMN list on the USIM, as above.
2. Signalling-level rejection. The home network declines the location update from a non-preferred visited network, causing the UE to place that PLMN in the forbidden list and try the next candidate. This is functional but blunt: it burns registration attempts, adds attach latency, and in the worst case leaves the subscriber on the least-preferred network of all, which is whichever one is left.

None of this is a defect. Steering exists because roaming wholesale rates differ by an order of magnitude between partners, and a home operator with tens of millions of outbound roamers has a legitimate margin interest in the outcome. The point is only that the selection function optimises for wholesale cost and partner commitments, and does not optimise for the security maturity of the receiving network.

IR.21

IR.21 is the GSMA document through which each operator publishes the technical parameters of its own network to its roaming partners: network node addresses, global title ranges, IMSI ranges, signalling point codes, Diameter realms, GRX/IPX details, APNs, and supported services. It is exchanged industry-wide through the GSMA's roaming agreement exchange process, and it is the substrate on which every roaming interconnect is actually built.

For an identity layer, IR.21 has two consequences that are easy to miss.

First, it enumerates the reachable attack surface. An operator's IR.21 publishes the global title ranges and node addresses that terminate MAP and Diameter signalling. That information is exactly what an SS7-based location or intercept attempt needs in order to address the right node. IR.21 is shared under roaming agreements rather than published openly, but the industry's own assessments have long acknowledged that the confidentiality of interconnect addressing is not a durable control. Any threat model that leans on the obscurity of GT ranges is leaning on a wall that has already fallen over.

Second, it defines what signals can exist at all. Whether a visited network supports SMS home routing, which release of the signalling stack it terminates, and which services it declares are all IR.21-governed facts. They determine whether an identity signal derived from a roaming session is meaningful or merely present.

The three signals that change shape

Not every carrier signal degrades the same way under roaming. Being specific about which is which is the difference between a risk model that works and one that produces noise.

SIM swap

A SIM swap is a home-network event. The subscription record, the IMSI-to-ICCID binding, and the change timestamp live in the home HLR/HSS regardless of where the subscriber is standing. Roaming does not move that record, and a well-implemented SIM-change signal remains authoritative while roaming.

What roaming changes is the corroboration. Domestically, a SIM change accompanied by an immediate location update from an unexpected cell is a strong composite. While roaming, the same composite is far weaker: the location update legitimately comes from a network the subscriber has never used, at a time and place the risk engine has no baseline for. The signal survives; the context that made it actionable does not. This is the same failure mode as treating signal strength as a substitute for signal freshness.

Port-out

Number portability is a domestic regulatory construct. A port-out is executed between two operators inside a single national numbering plan, and a roaming subscriber is not more or less portable for being abroad. The risk shift is operational rather than technical: a subscriber who is roaming, on a different time zone, and dependent on data connectivity for out-of-band contact is materially less likely to notice and contest a fraudulent port in the window that matters. Regulators have converged on notice-and-delay controls for exactly this reason, as reflected in the FCC's consumer alert on port-out fraud.

SS7 and Diameter interception

This is the signal class where the visited network's posture is decisive, and it is the one most identity products handle worst.

SS7 and Diameter interconnect attacks work by sending signalling messages that a receiving network should refuse. The classic MAP primitives, AnyTimeInterrogation, ProvideSubscriberInfo, SendRoutingInfoForSM, are legitimate inside a network and illegitimate from an arbitrary interconnect peer. The industry mitigation is category-based filtering at the network edge, complemented by SMS home routing so that message delivery does not require exposing the subscriber's current serving node to a foreign query. The GSMA's fraud and security group has published interconnect security monitoring and firewall guidance for years; the current public entry point is the association's interworking security material, and the European threat assessment context is set out in ENISA's threat assessment for 5G networks.

Here is the part that matters for identity: filtering quality is a per-operator property. A subscriber steered onto a partner with mature category-2 and category-3 filtering and home-routed SMS is in a meaningfully different threat environment than the same subscriber steered onto a partner without them. Same handset, same subscription, same home operator, different exposure. And the subscriber did not choose.

A visited-PLMN risk weighting model

What follows is our model. It exists because the alternative in most production risk engines today is a binary roaming: true flag, which is worse than nothing: it tells the engine to be nervous without telling it what to be nervous about.

The design constraints are the ones we apply to everything: the model must run on observable inputs, it must be zero-PII, and it must degrade honestly when an input is unavailable rather than inventing a number.

Inputs

Every input is a property of a network, never of a person. The unit of scoring is the PLMN identifier (MCC+MNC), which is not personal data and never becomes one. The same discipline keeps the rest of our pipeline out of PII scope entirely, described in zero-PII architecture.

Composition

The VPLMN trust coefficient is a weighted sum of normalised input scores, floored by a coverage penalty when inputs are missing:

VTC = ( Σ wᵢ · sᵢ ) · coverage_factor

where  sᵢ ∈ [0,1]                    normalised input score
       wᵢ                            weight from the table above
       coverage_factor = 0.6 + 0.4 · (observed_inputs / total_inputs)

A PLMN with no observable inputs cannot score above 0.60 × its
default prior. Absence of evidence is scored as absence of
evidence, never as evidence of safety.

The coverage factor is the part of this we argue hardest for. It is trivially easy to build a scoring model that rates an obscure operator highly because nothing bad has been observed about it. That is a sampling artefact. Penalising unobserved networks is the only honest treatment.

Applying the coefficient

The coefficient does not produce a verdict. It reweights the signals a risk engine already has:

A worked illustration of how the bands separate, using hypothetical partner profiles rather than named operators:

Partner profile                          VTC   Band
─────────────────────────────────────────────────────
5G SA, SAS-accredited, home routing,
category-3 filtering verified           0.91  ████████████████████  full
─────────────────────────────────────────────────────
4G/5G NSA, home routing, filtering
declared but unverified                 0.71  ███████████████       reduced TTL
─────────────────────────────────────────────────────
4G, no home routing, filtering
posture unknown                         0.48  ██████████            discount SMS
─────────────────────────────────────────────────────
Legacy 2G/3G fallback retained,
no observability at all                 0.31  ██████                second factor
─────────────────────────────────────────────────────
Values are illustrative outputs of the model above, and not
published measurements of any named operator.

We are deliberate about that last line. There is a whole genre of vendor content that publishes country-level or operator-level security league tables built on nothing but inference, and it does real damage: it defames operators that are fine and flatters ones that are not. The model is the contribution. The scores belong to whoever runs it against real, agreed observations.

Steering as a security control

If a home operator's steering decision changes a subscriber's exposure, then steering is a security control, and it should be governed like one. Three concrete positions follow.

Steering policy should carry a security term. Wholesale cost and partner commitments will and should dominate. But a tie-break term that prefers partners with home routing and verified filtering costs an operator almost nothing and measurably reduces the interconnect exposure of its own outbound roamers.

Identity vendors should expose the visited network, not just the roaming flag. Any attestation payload that reports roaming: true and stops has thrown away the only field that lets a relying party reason about the risk. Emit the serving PLMN identifier and, where a model like the above is running, the coefficient and its coverage factor. A relying party can act on that. It cannot act on a boolean.

Relying parties should stop treating SMS as a channel with uniform properties. SMS delivery to a subscriber on a mature 5G partner with home routing and SMS delivery to the same subscriber on a legacy partner without it are different security events that happen to look identical in an application log. A step-up flow that cannot distinguish them stops being a step-up flow while the user is abroad. This is the same argument as why SIM-swap detection alone is not a control, applied one layer down the stack.

Placement in the PasskeyBridge architecture

PasskeyBridge treats the serving network as an input to signal weighting rather than as a fact to be reported. The relevant properties, which readers can verify against the rest of our published architecture:

• The scoring unit is the PLMN, never the subscriber. Nothing in the model requires or retains a phone number, IMSI, or IMEI. Identifiers that transit the pipeline are hashed before storage.
• Coverage is reported alongside the coefficient, so a relying party can distinguish "we assessed this network and it scores well" from "we have never seen this network".
• Signal weighting under roaming interacts with our multi-provider signal fusion and with the circuit-breaker behaviour that governs what happens when a partner API degrades mid-session. A low-coefficient visited network and a degraded provider are different failure modes and must not be collapsed into the same fallback.
• The model is additive to, and no replacement for, eSIM profile-switching telemetry, which is increasingly the mechanism by which a device changes serving network at all.

If you want to see the primitives rather than read about them, the live API playground issues real signed requests against production edge, and the solutions overview maps the signal classes to the decisions they are meant to support.

Summary

Roaming has been treated as a coverage problem for thirty years and an identity problem for approximately none of them. The steering machinery is mature, integrity-protected in 5G, and entirely indifferent to the security posture of its destination. IR.21 governs what is reachable and therefore what is attackable. And the three signal classes identity products depend on most degrade in three different ways, which means a single roaming flag cannot possibly encode the risk.

The fix is not exotic. Score the network. Report the coverage. Weight the signals accordingly. Refuse to score what you have not observed.

That last one is the discipline that separates a model from a marketing table.

Start free · Test the API