How IMEI Verification Actually Works (And Why It Matters More Than Most People Think)

When you purchase a second-hand phone or try to sell one, it is highly likely that you have come across the term "IMEI", such as "make sure you check the IMEI number", "ensure it isn't blacklisted", etc. However, there is hardly any description about what actually happens when you check that number. Being someone who has spent a lot of time researching the whole procedure for the sake of content creation and process analysis, I feel it necessary to make things clear here since it is an extremely intriguing system, and people don't usually understand all the things that go into this 15-digit number.

What an IMEI actually is
The IMEI number means International Mobile Equipment Identity, a unique identifier that has 15 digits allocated to every mobile phone at the point of manufacture. It can be regarded as the hardware identity of the device rather than the SIM card or phone number. This feature allows the device to be traced independently of the current owner of the phone and the network it uses.
This information can be retrieved through the dialling code *#06#.

How the verification/blacklist system works
It gets even more interesting from a systems point of view. In most countries, telecom regulators have a centralised database which keeps track of IMEIs – in India this is known as CEIR (Central Equipment Identity Register). It's essentially a status database for every IMEI out there – with limited states: either active, lost/stolen, or blocked.

Once an IMEI becomes lost or stolen, it gets flagged in the CEIR database – either by its rightful owner or sometimes even by the telecom operators themselves. And once it's flagged, one would expect the status to get propagated across telecom operators – such that if the device ever tried connecting to any other network with a different SIM, it could get blocked in the network itself rather than in the application itself.

Why this matters for anyone building in this space
If you have any kind of product marketplace based on used devices, resale or asset tracking systems, IMEI verification makes for an interesting example of what makes centralised identity registries difficult – you work with a distributed system (several telecom operators), have asynchronous synchronisation, and need a real-time trust decision regarding a piece of technology that most people don't even know about.

From the resale perspective, it explains why a legitimate buyback service always has IMEI verification as one of the obligatory processes, rather than as something optional; it is simply the only way to distinguish a legitimate business deal from a big trouble that can come back a month later. For instance, CashNow, a phone buyback service, performs this verification even before providing an estimate to its customers, since not performing it only passes the problem further to someone else.

Takeaway
IMEI validation seems like an unexciting box that needs to be ticked during the process of reselling a device, but it’s actually an identity verification problem with a very straightforward user interface. Good to know if you’re working on something similar to reselling devices in the future.