The phone was still sealed in its box. Yet after researchers reported its identifier as lost, it could not connect to the mobile network. That demonstration exposes a larger problem: the anti-theft system intended to protect devices can become a cheap way to disconnect someone else's phone or a home alarm's cellular backup.

Michigan State University and collaborators described six weaknesses spanning devices, mobile operators and the cross-carrier system that shares lost-device records. Their MobiSys 2026 paper won a Best Paper Award. The university published its account on 9 September 2026; its page supplies no publication time. The paper itself dates from June, so this is new reporting and explanation of published research, not a newly discovered zero-day.

Every cellular device has an IMEI, an identifier separate from its phone number and SIM. When an owner reports a device lost or stolen, an operator can place that IMEI on a block list so the device cannot register on the network. The defense makes a stolen handset less useful. But it also creates an availability decision with consequences beyond the reporting customer.

The researchers tested the reporting practices of three major US carriers and associated resellers. They found weaknesses in how a reporter's identity and ownership were checked, what kinds of devices could be reported, and what trust information followed a block-list entry to other operators. A brief prior network attachment could be treated as evidence that a device belonged to a reporting account. That is not the same as proving ownership.

In the…