What is IMEI?

IMEI stands for International Mobile Equipment Identity: a 15-digit number that uniquely identifies a piece of mobile hardware. Every phone has one, and so does every GPS tracker with a SIM slot.

It identifies the device, not the SIM. Swap the SIM and the IMEI stays the same — which is exactly why tracking servers use it to recognise a returning tracker.

Where to find it

In rough order of reliability:

1. Printed on the device, usually on a label under the battery or on the back, often next to a barcode.
2. On the box, on the same label as the model number.
3. By SMS command. Most trackers reply to a status command with their IMEI — the exact syntax varies by model.
4. In the tracking platform, once the device has connected at least once.

Write it down before installing the tracker somewhere awkward. Retrieving it from a unit magnetically attached under a vehicle is a genuinely annoying job.

What the digits mean

35 - 209900 - 176148 - 1
│      │         │      └── Check digit (Luhn)
│      │         └───────── Serial number, assigned by the manufacturer
│      └─────────────────── Model identifier
└────────────────────────── Reporting body identifier

The first eight digits together form the TAC (Type Allocation Code), which identifies the make and model. The final digit is a Luhn checksum — the same algorithm used on credit cards — so a mistyped IMEI is usually detectable without contacting the network.

That check digit is genuinely useful when registering a device: validating it locally catches transcription errors immediately rather than leaving someone wondering why their tracker never appears online.

How trackers use it

When a GT06-family tracker connects to a server, its very first message is a login packet whose body is the IMEI. The server looks it up, decides whether it recognises the device, and replies with an acknowledgement. Every position report afterwards travels on that same connection, already identified.

This is why registering a hardware tracker works differently from registering a phone. A phone app is given an API key to send with each report. A tracker cannot be given anything — it only knows how to announce its IMEI. So the flow inverts: you tell the platform which IMEI belongs to your account, then point the tracker at the server by SMS.

The security problem

Worth stating plainly, because it is a real property of these devices rather than an implementation choice.

The IMEI is the only credential in the protocol, and it is not secret. It is printed on the device, on the box, and transmitted in cleartext over an unencrypted connection. Anyone who knows a tracker’s IMEI can connect to a server and claim to be that device.

There is no fix at the platform level. The protocol has no field for a shared secret, and these devices do not support TLS. Every platform that accepts GT06-family trackers — commercial and open source alike — has the same exposure.

What a platform can do is limit the blast radius:

• Never auto-create devices from an unknown IMEI. The IMEI must be registered to an account first, and unrecognised logins are dropped. Without this rule the ingest port is an open relay.
• Enforce uniqueness. One IMEI, one account, so a device cannot be claimed twice.
• Rate limit per device, so a flood of forged reports cannot overwhelm the system.

Geoblip’s hardware tracker support is built on these rules. They are also worth knowing as a buyer: if you are tracking something genuinely sensitive, a €25 2G tracker with no authentication is the wrong tool, and no service can make it the right one.

IMEI versus ICCID versus IMSI

Three identifiers that get mixed up:

Identifier	Identifies	Digits	Changes when
IMEI	The device hardware	15	Never
ICCID	The physical SIM card	19–20	You swap SIMs
IMSI	The subscriber on the network	15	You change plan or SIM

Tracking servers key on IMEI because it survives SIM changes — the device stays the same device. If your tracker stops reporting after a SIM swap, the IMEI is not the thing to check; look at the APN instead.

Last reviewed 7 August 2026.