IMSI Catcher
Also known as: Stingray, cell-site simulator, fake cell tower, cell site simulator, dirtbox, IMSI-catcher
An IMSI catcher is a portable fake cell tower that broadcasts a stronger signal than nearby real towers so phones nearby automatically connect to it. Once a phone connects, the device can harvest its IMSI, the unique SIM identifier that carriers map to a subscriber's name, pinpoint the phone's location, and on some models force a downgrade to weak 2G to intercept calls and texts.
IMSI catchers, widely known by the brand name Stingray (made by Harris Corporation) or the generic term cell-site simulator, exploit a foundational weakness in cellular design: a phone trusts whatever tower presents the strongest signal and, in older standards, does not verify the tower is genuine. The fake tower simply outshouts the real ones, and every phone in range connects to it.
On connecting, the phone reveals its IMSI (International Mobile Subscriber Identity), the permanent number stored on the SIM. A carrier can map an IMSI directly to a customer's name, billing address, and phone number, so capturing it deanonymizes everyone in the device's radius, not just a target. The catcher can also triangulate a phone's precise location and, by forcing a downgrade to 2G where encryption is weak or absent, intercept calls and SMS content.
IMSI catchers conduct a general dragnet of all nearby phones, which civil-liberties groups like the EFF argue violates basic constitutional protections. Modern units operate across 3G, 4G LTE, and even 5G. 5G tries to fix the core flaw by encrypting the permanent identifier (now called SUPI) and sending only an ephemeral encrypted SUCI per session, but real-world deployments still allow legacy fallback, and in March 2025 the EFF released Rayhunter, an open-source tool that flags catcher behavior such as suspicious 2G-downgrade requests. The lesson is that any identity anchored to a SIM can be silently captured by anyone with a few thousand dollars of radio gear.
How it works
1. The device transmits a cellular signal stronger than the legitimate towers in the area.
2. Phones, designed to latch onto the strongest signal, connect to the fake tower without any user-visible indication.
3. The catcher requests each connected phone's IMSI, harvesting the SIM identifier of everyone in range.
4. It measures signal strength and timing to locate target phones, often more precisely than the carrier could.
5. On vulnerable models it forces a downgrade to 2G, where weak or absent encryption lets it intercept call and SMS content before passing traffic along.
Frequently asked questions
Can an IMSI catcher decrypt my RVNT messages?
No. RVNT content is end-to-end encrypted and routed over Tor, so a catcher capturing the radio traffic sees only encrypted Tor cells. It cannot read your messages even if your phone connected to it.
What is the difference between a Stingray and an IMSI catcher?
They refer to the same class of device. 'Stingray' is a Harris Corporation brand name for a specific commercial cell-site simulator, while 'IMSI catcher' is the generic term for any fake tower that captures phones' IMSI identifiers.
Does using RVNT stop police from tracking my phone with a cell-site simulator?
Not at the radio level. The catcher still detects and locates your SIM card regardless of which apps you run. RVNT only ensures the app's identity and message content are not tied to your phone number or readable, not that your physical handset is invisible.
Every definition here describes something RVNT actually ships — a post-quantum, end-to-end-encrypted, peer-to-peer messenger with no phone number and no servers.