Theft Protection, often called IMEI lock, is a security feature that binds a Simbase SIM to the IMEI (the unique identifier of a cellular device) of the device it was first activated in. If the SIM is removed and inserted in a different device, the new device's IMEI won't match the locked one, and Simbase automatically disables the SIM.

This article covers what Theft Protection does, when it's worth turning on, and the one operational gotcha you need to plan for.

When to use Theft Protection

What it protects against

• SIM theft. A stolen SIM placed in a different device is locked out before it can pass any traffic

• Unauthorised repurposing. A SIM removed from a deployed device and placed in a personal phone (intentionally or not) won't work

• Fraud/data theft. Sensitive data accessed via a Simbase SIM is harder to exfiltrate if the SIM itself only works in the original device

What it doesn't protect against:

• A compromised device. If the device itself is compromised, the SIM still works in that device. Theft Protection only checks the IMEI, not the integrity of the firmware

• SIM cloning. Theft Protection works on what the network sees during attach. It doesn't prevent the SIM secret being extracted from a stolen card

• Data interception in transit. Use TLS and/or a VPN for that

How it works

The first time a SIM with Theft Protection enabled attaches to a network in a device, Simbase records that device's IMEI against the SIM. On every subsequent attach, Simbase checks the reported IMEI:

• Match: attach allowed, SIM passes traffic as normal

• Mismatch: SIM is automatically disabled, traffic stops immediately, and Simbase emails the technical contact on the account

If the SIM gets disabled by an IMEI mismatch, it stays Disabled until you intervene. Either disable Theft Protection and re-enable the SIM, or move the SIM back into the original device.

Enable Theft Protection

Per SIM, in the dashboard

1. Sign in to dashboard.simbase.com

2. Open the SIM you want to protect

3. Find the Theft Protection toggle

4. Switch it on

The SIM is now bound to the IMEI it next attaches with. If it's already attached in a device, that device's IMEI is recorded immediately.

Via the API

1. Create an API key with the simcards.details:write scope, from Integrations → API in the dashboard. Keys are scoped on creation and scopes cannot be changed afterwards

2. Send a PATCH request to the SIM, setting imei_lock to on

Request

PATCH /v2/simcards/{ICCID} HTTP/1.1
Host: api.simbase.com
Authorization: Bearer YOUR_API_KEY
Content-Type: application/merge-patch+json
​
{
  "imei_lock": "on"
}

Response

A successful call returns 200 listing the fields that changed.

{
  "message": "Simcard updated successfully",
  "updated_fields": [
    "imei_lock"
  ]
}

The SIM latches to its current IMEI, or to the first IMEI it attaches with if it isn't connected yet. Same behaviour as the dashboard toggle.

To turn it off, send "imei_lock": "off". This clears the binding and the SIM can attach in any device.

Disable Theft Protection

The same steps, in reverse:

1. Open the SIM in the dashboard.

2. Toggle Theft Protection off.

After disabling:

• The IMEI binding is cleared

• The SIM can attach in any device

• If you re-enable Theft Protection later, the binding starts fresh. The next IMEI to attach becomes the new locked IMEI

Plan for legitimate device swaps

This is the biggest operational consideration: whenever you swap the device a SIM lives in, you have to disable Theft Protection first. Otherwise:

1. You move the SIM into the replacement device

2. The device powers on and attaches with its new IMEI

3. Simbase sees the mismatch and auto-disables the SIM

4. You now have a disabled SIM in the field, and it can only be re-enabled from the dashboard or API

The correct flow:

1. Disable Theft Protection on the SIM in the dashboard before the physical swap

2. Swap the SIM into the new device

3. Power the new device on. Let it attach successfully

4. Re-enable Theft Protection. The new device's IMEI becomes the new locked IMEI

For organisations doing frequent field swaps, consider scripting this via the API.

Checking IMEI status

In the dashboard

1. Open the SIM in the dashboard.

2. The Theft Protection field shows the toggle state and the locked IMEI, if any.

3. Use this to verify a SIM is bound to the device you expect, which is useful during deployment QA.

Via the API

Retrieve the SIM with GET /v2/simcards/{ICCID}. The key needs the simcards.details:read scope.

GET /v2/simcards/{ICCID} HTTP/1.1
Host: api.simbase.com
Authorization: Bearer YOUR_API_KEY

The response includes both values, abridged here:

{
  "iccid": "8912340400000000000",
  "imei": "356938035643021",
  "imei_lock": "off",
  "state": "enabled"
}

imei_lock is on or off. imei is the IMEI the SIM is currently reporting, which is the locked IMEI when the lock is on.

To audit a fleet, list your ICCIDs with GET /v2/simcards and call the detail endpoint for each, staying within the limit of 10 calls per second.

Common questions

Related

• SIM state, what happens when a SIM is disabled by Theft Protection

• Diagnostics, flags Theft Protection mismatches

• API, programmatic Theft Protection control

• VPN, additional security beyond IMEI lock