Theft protection, often called IMEI lock, is a security feature that binds a Simbase SIM to the IMEI (the unique identifier of a cellular device) of the first device it is used in. If the SIM is removed and inserted in a different device, the new device's IMEI won't match the locked one, and Simbase automatically disables the SIM.

This article covers what Theft protection does, when it's worth turning on, and the one operational gotcha you need to plan for.

When to use Theft protection

What it protects against

• SIM theft. A stolen SIM placed in a different device is locked out as soon as the IMEI change is detected.

• Unauthorized repurposing. A SIM removed from a deployed device and placed in a personal phone (intentionally or not) won't work.

• Fraud and data theft. Sensitive data accessed via a Simbase SIM is harder to exfiltrate if the SIM itself only works in the original device.

What it doesn't protect against:

• A compromised device. If the device itself is compromised, the SIM still works in that device. Theft protection only checks the IMEI, not the integrity of the firmware.

• SIM cloning. Theft protection works on the IMEI the network reports. It doesn't prevent the SIM secret being extracted from a stolen card.

• Data interception in transit. Use TLS and/or a VPN for that.

How it works

The first time a SIM with Theft protection enabled generates network activity in a device, Simbase records that device's IMEI against the SIM. Every time the network reports the IMEI after that, Simbase checks it:

• Match: attach allowed, SIM passes traffic as normal.

• Mismatch: the SIM is automatically disabled the moment the change is detected, traffic stops, and Simbase emails the technical contact on the account.

If the SIM gets disabled by an IMEI mismatch, it stays Disabled until you intervene. Either disable Theft protection and re-enable the SIM, or move the SIM back into the original device.

Enable Theft protection

Per SIM, in the dashboard

1. Sign in to dashboard.simbase.com.

2. Open the SIM you want to protect.

3. Find the Theft protection toggle.

4. Switch it on.

The SIM is now bound to the next IMEI reported for it. If it's already attached in a device, that device's IMEI is recorded immediately.

Via the API

1. Create an API key with the simcards.details:write scope, from Integrations → API in the dashboard. Keys are scoped on creation and scopes cannot be changed afterward.

2. Send a PATCH request to the SIM, setting imei_lock to on.

Request

PATCH /v2/simcards/{ICCID} HTTP/1.1
Host: api.simbase.com
Authorization: Bearer YOUR_API_KEY
Content-Type: application/merge-patch+json
​
{
  "imei_lock": "on"
}

Response

A successful call returns 200 listing the fields that changed.

{
  "message": "Simcard updated successfully",
  "updated_fields": [
    "imei_lock"
  ]
}

The SIM binds to the IMEI it's currently reporting, or to the first IMEI reported for it if it hasn't been seen on the network yet. This is the same behavior as the dashboard toggle.

To turn it off, send "imei_lock": "off". This clears the binding and the SIM can attach in any device.

Turn Theft protection off

The same steps, in reverse:

1. Open the SIM in the dashboard.

2. Toggle Theft protection off.

After disabling:

• The IMEI binding is cleared.

• The SIM can attach in any device.

• If you re-enable Theft protection later, the binding starts fresh. The next IMEI reported becomes the new locked IMEI.

Plan for legitimate device swaps

This is the biggest operational consideration: whenever you swap the device a SIM lives in, you have to disable Theft protection first. Otherwise:

1. You move the SIM into the replacement device.

2. The device powers on and attaches with its new IMEI.

3. Simbase sees the mismatch and auto-disables the SIM.

4. You now have a disabled SIM in the field, and it can only be re-enabled from the dashboard or API.

The correct flow:

1. Disable Theft protection on the SIM in the dashboard before the physical swap.

2. Swap the SIM into the new device.

3. Power the new device on and let it attach successfully.

4. Re-enable Theft protection. The new device's IMEI becomes the new locked IMEI.

For organizations doing frequent field swaps, consider scripting this via the API.

Checking IMEI status

In the dashboard

1. Open the SIM in the dashboard.

2. The Theft protection field shows the toggle state and the locked IMEI, if any.

3. Use this to verify a SIM is bound to the device you expect, which is useful during deployment QA.

Via the API

Retrieve the SIM with GET /v2/simcards/{ICCID}. The key needs the simcards.details:read scope.

GET /v2/simcards/{ICCID} HTTP/1.1
Host: api.simbase.com
Authorization: Bearer YOUR_API_KEY

The response includes both values, abridged here:

{
  "iccid": "8912340400000000000",
  "imei": "356938035643021",
  "imei_lock": "off",
  "state": "enabled"
}

imei_lock is on or off. imei is the IMEI the SIM is currently reporting, which is the locked IMEI when the lock is on.

To audit a fleet, list your ICCIDs with GET /v2/simcards and call the detail endpoint for each, staying within the limit of 10 calls per second.

Common questions

Related

• SIM state — what happens when a SIM is disabled by Theft protection

• Diagnostics — flags Theft protection mismatches

• API — programmatic Theft protection control

• VPN — additional security beyond IMEI lock