@lightbeyond wrote:
I still don't have an answer to my question of exactly how a modern GSM phone can be cloned. I haven't heard any solid evidence of this happening, only hearsay. It's not hard to find IMEI numbers if you want them, so even if it were possible by having only a number, why would someone go to the lengths of buying (or pretending to buy) a phone on Ebay just to obtain a number? I think it's more likely that a fraudster would purchase the phone, swap out the innards with another blocked phone, and then return it for money back - all making the point of not giving out the IMEI a moot one.
Finally, someone that makes sense.
There is a TON of misinformation and fear-mongering going on surrounding the IMEI issue, and I've recently ran into trouble looking at buying a phone myself. So, I'm going to break it down:
You cannot, read: CANNOT, clone a phone using only the ESN/IMEI number.
"Cloning" a phone is something that's actually way more effort than it's worth these days - it's almost never done anymore, given the tools carriers have put in place to catch it, and it's certainly not done as easily as it's being portrayed. Cloning a phone requires hacking a device to mirror a currently active, in-use account, SO THAT IT CAN BE USED for calls, and data on someone else's dime. If the phone you're trying to sell does not have an active SIM card in it, or is not tied to an active phone account, CONGRATULATIONS, your phone cannot be cloned. "Cloning" a phone is not just cloning the device - it does not erase a bad ESN and replace it with a good one. It mimicks someone else's active account so that you can run up the bill with all of those calls to Pakistan before Verizon figures it out. And these days, they figure it out pretty darn fast - 24 hours max from the first use, that phone will be disabled. It's easier and less effort to just steal a phone outright.
You need at least the IMEI number AND the MIN (phone number) and/or SIM card, to clone a phone. You CANNOT obtain a MIN (phone number) from the IMEI number alone. If you don't give out your phone number, or give out an active SIM card, you are in no danger of having your IMEI "stolen".
Here's a very simple article that lays it out: https://en.wikipedia.org/wiki/Phone_cloning (Yes, I know, it's Wikipedia, but this article is accurate.)
Think about it - IMEI numbers are posted prominently on the packaging of any phone, and are easily retrievable from any device itself. If all you need is the IMEI number, and some non-working phone to transfer it to, what's to stop people from stealing the numbers on the packaging at cell phone stores? How about a handler intercepting a large shipment of phones, but just writing down the numbers? Yeah, no. What would stop an unscrupulous buyer from simply completing the sale, getting this information from the phone itself, then returning the item "SNAD" for a full refund? Is this happening? I'm sure there are invalid SNAD returns all of the time, but this is not one of the reasons.
I get it - your uncle's cousin's brother's son gave out their phone's IMEI, and their phone was "cloned". Uh huh. Customer service reps have told you not to give out the IMEI number, for "security reasons". Either they, too, are misinformed, or you're misunderstanding what they mean by "security reasons" - it's THEIR security they're worried about. An IMEI tied to an active account COULD be a piece of information used to gain access to your account, but is this phone you're selling tied to your active account? No? Then what are you worried about?
If your answer to my last question was "yes, it's tied to my active account" - buyers should be wary of YOU.
The reason prospective buyers ask for the IMEI, is in an attempt to verify that the phone has not been "blacklisted", which can be done by the carrier as a result of one of two things: the phone being reported lost or stolen, or the original owner fails to fulfill a financial agreement (contract or payment plan). The first one can be verified easily through multiple sources using just the ESN/IMEI number. The second one, however, is often difficult to verify – even with the IMEI - and is how buyers are getting scammed by sellers in this secondary cell phone market. You can use the IMEI number of a phone to verify that the device is in good standing now, but there’s nothing to say that someone won’t renege on their contract, or payment plan, and stop paying their bill a week, a month, even six months from now. It doesn’t matter that they’re using a different phone on that account, or that the phone you bought from them has long been activated on your separate account – their deal was made contingent on the value of THAT PHONE, the one you bought from them, and you could find yourself with a useless paperweight.
Giving out the IMEI number on a phone is not the way sellers get scammed – it’s buying and reselling phones you don’t know the origin of.
This is a huge problem, for buyers and sellers alike. If you’re selling your own previous personal phone, that’s one thing, but if you are buying and reselling phones from other 3rd parties, you might have no way of knowing if the original owner might one day get that phone blacklisted. This is an active scam that is happening right now – sell a good condition, clean ESN/IMEI phone to an unsuspecting person, they’ll activate the phone and use it while the original owner racks up a bill on their account, the original owner walks away from paying the bill, and 2-3 months down the line, the phone gets deactivated – permanently. The fact that it takes 2-3 months is how the scam gets carried out - carriers won’t blacklist the phone immediately due to non-payment, they’ll send a bill, then a late notice, then they’ll send collectors after you – deactivating the phone is a last resort, “okay, they’re not paying” punishment that gets handed down to whoever happens to be using the phone at the time. A lot of people don't realize this, and will leave positive feedback shortly after buying a phone, and seeing that it works - which means just because a cell phone seller's rating is stellar, doesn't mean they haven't had unhappy customers. Ebay’s return policy is only 30 days. Sure, you can fight it with Paypal, but they might not back you.
Give out the IMEI number all you want – it’ll help you make a sale, and give the buyer peace of mind. However, it’s a false sense of security – you can’t predict the future behavior of the original owner of the phone.
The takeaway: it’s not safe to buy OR sell used cell phones on ebay. Or anywhere else.
Not until carriers change the way they handle non-payment of accounts…and this particular system is very friendly to their bottom line. (You have to buy a new phone from them, since the secondary market can’t be trusted.) So, yeah, I don’t see that happening anytime soon.
