TUCoPS :: Phreaking Cellular - Misc. :: cell_07.txt

Telecom Bandit's files on Cellular Fraud


PART VII.         THE ELECTRONIC SERIAL NUMBER - AN INTRODUCTION

        When a cellular phone is removed from factory packaging, the ESN
normally can be found in the document package (or on a sticker stuck to the
phone).  This ESN is usually correct and system registration procedes
quickly.  If the phone is used or has been turned off for non-payment of
bills, the person who restores the service needs the ESN in order to program
the system with an MIN.  Every manufacturer assigns their own ESN, 
consequently it is possible to have a number of the same ESN's, although
each may be produced by a seperate manufacturer.  For example, there may be
a Motorola ESN of 123456, an Audiovox ESN of 123456, etc.  With this in mind
it is a possibility that a person could broadcast without changing the ESN,
but rather changing the SCM and the SIDH.

        The ESN is a 32-bit number which uniquely identifies each unit.  This
ESN is factory programmed and installed and cannot be changed in the field
without removing it and reprogramming a new chip.  The ESN may or may not be
related to the serial number stamped on the outside of the transceiver 
chassis.  The ESN is encoded into messages which are interchanged with the
cellular tower.  The ESN must be provided when the phone is registered for
service.  The ESN is an 11-digit number.  THE FIRST THREE NUMBERS ARE THE
MANUFACTURERS DECIMAL CODE, THE NEXT TWO ARE RESERVED (BUT MAY CONTAIN ZEROS
OR NUMBERS) AND THE REMAINING SIX ARE THE DECIMAL SERIAL NUMBER.

*****************************************************************************


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH