What an IMEI blacklist is, and what it is not

When a phone is reported lost or stolen, its IMEI can be added to a blacklist. The device then stops being able to attach to networks that honour that list. It is one of the few controls in mobile that acts on the hardware rather than on the account, and it is genuinely useful — provided you understand what it does.

The mechanism

Every operator maintains an Equipment Identity Register — an EIR — against which it can check the IMEI of a device attempting to attach. Traditionally the register is described as three lists:

Individual operator registers are then shared upward. The GSMA runs a central register that lets participating operators exchange blocked identifiers, so that a handset blocked on one network can be blocked on others rather than simply being resold across the street. Several countries additionally run their own national registers, mandated by their telecoms regulator.

The four things it does not do

Most of the disappointment around blacklists comes from expecting them to be something else. Precisely:

1. It is not a location service. Blocking a device does not tell anyone where it is. Locating a handset is a carrier and law-enforcement operation, and it needs the device to be on a network.
2. It does not touch your data. A blocked phone is denied cellular service; the photos and accounts on it are unaffected. That is what remote wipe is for, and it is a separate action.
3. It does not stop the device working. Wi-Fi still works. A blocked handset is perfectly usable as a media player, a camera, or a resale item to a buyer who never inserts a SIM.
4. It is not an ownership record. A blacklist answers "has anyone reported this identifier", not "who owns this device".

Why coverage is uneven

Participation in shared blocking is not universal. Operators join the central exchange voluntarily unless a regulator compels them, and there are markets where the practical answer to a device blocked elsewhere is that it simply works. This is the structural reason stolen handsets move across borders: the block is real, and the block is local.

The reporting delay

There is always a window between a theft and the entry appearing in a register — the victim has to notice, report to their carrier or the police, and have the report processed. That window is measured in hours or days, not seconds. For anyone buying used hardware, it means a recently stolen device can pass a blacklist check honestly, because nothing has been filed yet.

This is a limitation of timing, not of the system. It is also the single strongest argument for not relying on one signal.

Reading a check properly

If you are building or running an intake process, the useful framing is that a blacklist result is evidence with a direction of certainty. A hit is strong evidence of a problem. A miss is weak evidence of no problem.

Signals worth combining with it:

• Activation lock state. A handset still tied to someone else's account is unsellable and, in practice, a far harder obstacle than a network block.
• Whether the declared model matches what the IMEI resolves to. A mismatch between the phone in front of you and the record behind the number deserves attention.
• Proof of purchase, and whether the seller can produce it without improvisation.
• Physical evidence of the identifier having been tampered with — the printed IMEI on the tray disagreeing with the one the software reports.

On altered identifiers

Reprogramming a device's IMEI is a criminal offence in a number of jurisdictions, and possession of the equipment to do it is separately an offence in some. From a buyer's side, the relevant point is defensive: if the number printed on the hardware and the number the device reports do not agree, stop. That single discrepancy is worth more than any online check.