3GPP Limited Service State and Unauthenticated Emergency Attach: How Smartphones Complete Emergency Calls Without a SIM

A smartphone completes an emergency call without a SIM card by deliberately abandoning its subscriber identity and broadcasting its permanent hardware serial number to the nearest available cell tower. The network receives a specialized "emergency attach" flag, suspends its standard cryptographic security checks, and routes the audio directly to a dispatcher.[1][2]

This mechanism is not a software trick built into iOS or Android, but a foundational requirement of global cellular infrastructure. Defined by the 3GPP telecommunications standards body, the protocol forces competing carriers to carry unauthenticated emergency traffic for free, prioritizing it above their own paying customers.[1][3]

To understand how this bypass works, you have to look past the operating system to the baseband processor. This dedicated cellular modem operates independently of the main phone hardware, running its own real-time operating system to manage radio frequencies and network handshakes.[4]

Under normal conditions, the baseband reads the International Mobile Subscriber Identity (IMSI) from the SIM card. It uses this cryptographic key to prove to the network's billing gateways that the user has an active, paid account authorized to consume bandwidth.[1]

When a user removes the SIM card, or travels outside their carrier's roaming agreements, the baseband processor fails this initial check. Instead of shutting down the radio, the modem enters a fallback mode known in 3GPP specifications as the Limited Service State.[1]

"In Limited Service State, the user equipment is restricted to originating emergency calls and receiving public warning system messages," states the 3GPP Technical Specification 24.301. The phone actively scans all supported frequency bands, searching for any compatible cell tower, regardless of the corporate logo painted on the mast.[1]

Bypassing the Cryptographic Handshake

Once the baseband finds a signal, dialing 911 or 112 triggers a completely different network sequence than a standard phone call. The device transmits an Attach Request to the tower, but changes a critical data field: the Attach Type is explicitly set to "EPS emergency attach."[1]

Because the phone lacks a SIM card, it cannot provide an IMSI. Instead, it transmits its International Mobile Equipment Identity (IMEI), a 15-digit hardware serial number hardcoded into the modem at the factory, offering device identification without subscriber authentication.[1][4]

The cell tower forwards this request to the core network's Mobility Management Entity (MME). For a standard call, the MME would initiate the Authentication and Key Agreement (AKA) protocol, a complex cryptographic challenge that verifies the SIM card's secret key against the carrier's database.[1]

The emergency attach flag instructs the MME to skip the AKA protocol entirely. The network accepts the unauthenticated IMEI, assigns the device a temporary IP address, and establishes a dedicated bearer channel with the highest possible Quality of Service priority.[1][2]

This security bypass physically accelerates the connection. A standard authenticated LTE attach requires exchanging roughly 13 to 15 signaling messages between the phone and the core network before audio can flow, introducing measurable latency.[1][4]

By discarding the authentication and security mode commands, the unauthenticated emergency attach reduces the sequence to just seven to nine messages. This protocol shortcut shaves critical milliseconds off the call setup time, opening the audio channel to the dispatcher faster than a standard commercial call.[1][4]

"The network must be prepared to handle emergency sessions from unauthenticated users," notes the GSMA's official guidelines on IP Multimedia Subsystem emergency deployments. "The serving network accepts the emergency attach without subscriber validation."

Routing to the Dispatcher

The actual voice data is packetized using the Session Initiation Protocol (SIP). When the phone sends the SIP INVITE message to initiate the ringing, it includes a special Uniform Resource Name (URN) formatted as "urn:service:sos", signaling its priority to every router along the path.[2]

If a cell tower is congested with users streaming video, the base station will actively drop paying customers' packets to ensure the unauthenticated emergency SIP packets arrive without jitter. The traffic is directed to an Emergency Call Session Control Function (E-CSCF), bypassing commercial billing nodes entirely.[2][4]

This specialized E-CSCF server acts as a geographic traffic cop, determining the caller's physical location based on the cell tower's coordinates. It queries a routing database to identify the correct Public Safety Answering Point (PSAP) for that specific jurisdiction.[2]

In the United States, there are over 5,700 distinct PSAPs, ranging from massive urban call centers to single-desk rural sheriff's offices. Modern smartphones supplement the cell tower's rough location data by activating their internal GPS receivers during the call.[3][4]

Using protocols like Advanced Mobile Location (AML), the handset silently texts its precise coordinates directly to the dispatcher. The handset formats the GPS coordinates as a specialized SMS message, which the network routes over the control channel rather than the standard data bearer.[4]

This means even if the unauthenticated attach only secures a bare-minimum 2G or 3G connection in a remote area, the precise latitude and longitude can still squeeze through the network's signaling pathways. Without an active billing profile, the dispatcher has no home address to fall back on, making this telemetry vital.[4]

The Regulatory Mandate

Telecommunications companies do not build and maintain this unauthenticated infrastructure out of corporate goodwill. The capability is strictly mandated by federal law in nearly every developed nation, overriding commercial interests.[3][4]

In the United States, the Federal Communications Commission enforces 47 CFR § 9.10, which requires all commercial mobile radio service providers to transmit all 911 calls. The rule explicitly forbids carriers from checking for validation or billing status before connecting the audio.[3]

If an AT&T customer drives into a rural valley where only a Verizon tower exists, the phone enters Limited Service State and places the emergency call over the Verizon network. Verizon must carry the traffic, route it to the PSAP, and absorb the infrastructure cost.[3][4]

Regulators enforce this mandate through the spectrum licensing process. A carrier that refuses to process unauthenticated emergency traffic risks losing the billions of dollars it spent acquiring the rights to broadcast on those radio frequencies.[3]

The European Communications Committee enforces similar rules for the 112 emergency number across the European Union. The technical standards are harmonized globally, ensuring that a Japanese smartphone without a SIM card can successfully dial 911 on a Canadian cell tower.[4]

Vulnerabilities and Network Abuse

Designing a network to accept unauthenticated, anonymous connections creates inevitable security vulnerabilities. Because the system trusts the hardware IMEI without cryptographic proof, malicious actors can exploit the protocol to mask their identities.

Software tools can spoof a device's IMEI, generating a fake 15-digit number before initiating the emergency attach. This allows attackers to place anonymous, untraceable calls to emergency services, bypassing the carrier's ability to block repeat offenders.[4]

This vulnerability is frequently exploited for "swatting" attacks, where bad actors call in fake hostage situations or bomb threats to trigger a massive police response at a target's address. The unauthenticated nature of the call makes it exceptionally difficult for law enforcement to trace the perpetrator.

"The 3GPP emergency architecture represents a deliberate trade-off between universal access and network security," explains a 2026 report from the European Union Agency for Cybersecurity. "We accept the risk of anonymous abuse to guarantee that a stranded motorist can reach an ambulance."

Network engineers are currently developing new 3GPP Release 19 standards that attempt to cryptographically sign the IMEI using a hardware secure enclave. This would prevent software-level spoofing while still allowing SIM-less devices to connect, though widespread deployment across legacy cell towers remains years away.[1][4]