What happens if an attacker steals my phone's IMEI number?

Question

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if possible.

Hypothetically, an enemy of mine gets a hold of the IMEI number and only the IMEI number of my smartphone. Can he steal or view my data with it?

As far as I know, with an IMEI number, you can report a phone stolen and it will get blocked. Or you can clone the IMEI on another device. What are the implications and consequences if someone clones my IMEI on another device other than the risk of getting the IMEI blocked?

I have also read that if a person has your IMEI number they can easily hack into your WhatsApp account, if they also have your phone number, since the IMEI is viewed as the password for WhatsApp.

My biggest concern is not that my phone would get blocked, it is that someone that has my IMEI number can view my personal data on my smartphone. Emails, pictures, texts, social media, eavesdropping etc... Can someone do that with just the IMEI number? And if so, why is this number so easily obtainable? You can find it on the box of the smartphone and numerous other ways to obtain it on the phone. Including some apps that make use of it. I also see people posting their IMEI on forums. How safe is that?

Answer 1

IMHO the IMEI is a device identifier (International Mobile Station Equipment Identity). You can retrieve it from any device by dialling *#06#. So it´s not a real secret, and anyone borrowing your phone for a short moment can get hold of it. The IMEI is bound to the device, not your phone number or account. It could be used to track stolen phones, and to lock them out from networks (done in a few countries, but not across borders or carriers normally, they could not agree on a global DB). However, some phones apparently allow changing the IMEI, which is of course a bad idea (why hardware vendors allow such things BTW, is it too hard to burn in a number of bytes and then make them read-only?) and people could overwrite it easily.

If WhatsApp would use the IMEI for personal identity I could not change my phone anymore, if my old one breaks. The whole idea of GSM was and is that you are not bound to the phone, rather you are just bound to the SIM card, and that is what needs to be protected. The SIM is your key to your telephone number, that´s the reason why you got a PIN code and why it locks you out after 3 failed attempts...

I don´t believe there is any identity theft possible by knowing telephone number and IMEI. You need to get hold of the SIM card, somehow hack it and retrieve the IMSI. This is what identifies you against the mobile provider. Read this: https://www.quora.com/What-is-the-difference-between-ICCID-IMSI-and-IMEI-numbers

Even your telephone number does not need to be stored on the SIM. For example, my private datacard-only SIM displays an invalid phone number when asked, but on my invoice I can see a real one, which even accepts SMS.

Answer 2

I have also read that if a person has your IMEI number they can easily hack into your WhatsApp account, if they also have your phone number, since the IMEI is viewed as the password for WhatsApp.

This is basic FUD. WhatsApp works over TCP and doesn't have anything to do with the phone network. You could run WhatsApp over Ethernet from your home network. WhatsApp only requires you to confirm the ownership of a phone number by entering a code they text you as they don't have usernames and rely on phone numbers to identify people, but once that's done, you can completely throw away your phone and use a computer for WhatsApp and it'll still work fine.

Moreover, even if someone manages to intercept the number confirmation SMS (impossible with just IMEI spoofing) they will only be able to take over your phone number and receive future messages, but not read anything you've received so far.

Even if the carrier's network is compromised beyond repair and the attacker is able to intercept your traffic, they won't be able to understand it as WA uses encryption to talk to their servers. Sure, at this point they would be able to intercept the number confirmation text message and take over your WA identity, but you would definitely notice (you'll just get logged out from WA) and they still won't be able to read your past messages.

it is that someone that has my IMEI number can view my personal data on my smartphone

Any app that would upload your personal data (to a cloud for example) will do so over an encrypted connection and will use a carrier-independent username and password. They don't use the IMEI to identify you and IMEI spoofing alone doesn't even give the attacker a way to eavesdrop on your traffic (not that it'll help them much because encryption).