IMSI catchers are real, they’re used, and the surveillance they enable is not paranoia. That’s exactly why the topic attracts so much junk. Around a genuine threat has grown a market of detector apps and anti-surveillance gadgets that mostly don’t do what they claim. Here’s how to tell the real mitigations from the snake oil.

The threat is real

A cell-site simulator can impersonate a tower, collect the identifiers of nearby phones, and in some cases force a downgrade to old 2G protocols to intercept calls and texts. Law enforcement agencies use them, and the hardware is no longer exotic. If you’re in a crowd that someone wants to map, or you’re a specific person someone wants to locate, this is a plausible tool against you. None of what follows is meant to wave that away.

Why most detector apps are snake oil

Search any app store and you’ll find apps promising to detect Stingrays or alert you to fake towers. Treat them with deep skepticism. The problem is structural. To reliably spot a cell-site simulator, you need low-level visibility into what the phone’s baseband, its cellular modem, is doing, and on a normal phone the operating system simply doesn’t expose that to apps. The baseband is a closed world. An ordinary app is guessing from the thin signals it can see, like a change in network type, and those signals have innocent explanations far more often than not.

So most of these apps generate false alarms, miss real events, or both, while giving users a dangerous sense that they’re covered. A few serious research tools exist, but they typically require specific chipsets, rooted devices, and technical setup, and even they come with heavy caveats. The polished consumer app promising one-tap Stingray detection is the tell that you’re looking at the snake-oil end of the market.

What actually reduces your exposure

The good news is that the real defenses are simpler than detection, and they don’t depend on catching the device in the act.

Disabling 2G is the big one. Because interception generally relies on downgrading your phone to the old, weak 2G protocol, a phone configured to refuse 2G removes the path most catchers use. This is a real setting on modern hardened Android, and it does more for you than any detector app ever will.

Using end-to-end encrypted apps for your actual conversations is the other half. If your messaging and calls run through Signal, the content is protected regardless of what’s happening at the tower level. And dropping reliance on SMS, including for two-factor codes, closes one of the most valuable things an interceptor could grab.

The honest bottom line

You probably cannot reliably detect an IMSI catcher as a normal user, and any product that tells you otherwise is selling confidence rather than capability. What you can do is make yourself a poor target: turn off 2G so the downgrade trick fails, run your communications through real encryption so there’s nothing useful to intercept, and treat the cellular channel as untrusted by default. That’s less exciting than an app with a radar animation. It’s also what actually works.

Related reading

• How IMSI Catchers Work (and How to Spot One)
• Secure-Phone Marketing Claims, Fact-Checked
• Why Calls and SMS Aren’t Private: SS7, Explained