A sealed, unopened phone can be permanently knocked off the cellular network by someone who never touched it, for less than the price of a coffee.
Researchers at Michigan State University and three partner schools proved it. They bought a Samsung Galaxy Z Fold 7, read the identification number printed on the still-sealed box, and reported the handset as lost. When they finally opened it and set it up, it would not connect.
Across the devices, the carrier systems that accept loss reports, and the shared block lists carriers run, the team catalogued six weaknesses. On three major U.S. carriers and their resellers, blocking hardware they did not own cost $2.50 to $4 and took roughly 20 to 80 seconds.
The mechanism rests on the 15-digit IMEI, a factory-burned serial kept separate from the SIM, phone number, and account. A loss report drops that IMEI into an Equipment Identity Register, and the network then refuses to register the device, whoever holds it and whatever SIM sits inside.
For a genuinely stolen phone that is exactly right. The weak point is what stops a stranger from submitting someone else’s number. When opening prepaid accounts, none of the three carriers verified a Social Security number or a government ID, leaving reports open to anyone with service paid by a gift card.
Ownership checks were thinner still. Carriers infer ownership from whether a device was briefly active on the account, something a spoofed device can manufacture; one carrier needed just one second of attachment. Reports also sailed through for smartwatches, industrial cellular boards, and a phone unable to run on the carrier’s frequencies. Once blocked, none of them could return.
