IMSI

The IMSI (International Mobile Subscriber Identity) is the unique identifier stored on a SIM that identifies a subscriber to the mobile network. It is distinct from the phone number: the number is a routing label that can move between SIMs, while the IMSI is bound to the SIM itself, which is why IMSI changes are a primary observable in SIM-swap detection.

The separation between number and IMSI is what makes swap detection possible at all. Because the number is a routing label, it can be reattached to a different SIM without the subscriber acting, and the network records that reattachment. Systems that treat the phone number as the identity are watching the label rather than the thing the label points at.

The consequence for system design is that a phone number is a routing label rather than an identity, and labels are reassignable by parties outside the relying system. Every account that treats the number as a stable key inherits that property, including the ones affected by silent number recycling, where no attacker is involved and the binding still breaks.

IMSI itself is a subscriber identifier, which places it squarely in the category of data a relying party should not be storing in the clear. Where it is used at all, it is used as an observable that changed rather than as a value to retain, and the retained form belongs behind keyed hashing like any other low-entropy identifier.

The observable is also why detection is possible without the subscriber doing anything. The network records the reattachment of a number to a different SIM as a matter of routine operation, so the evidence exists before anyone suspects a problem, which is what separates a carrier-sourced signal from one assembled on the device.

Watching the label rather than the thing the label points at is a mistake that only becomes visible after it has cost something.