Not sure about GSM and 3G, but 4G handsets do not transmit the IMSI during cell handover. They exclusively transmit the IMSI during 1) initial connection, that

Not sure about GSM and 3G, but 4G handsets do not transmit the IMSI during cell handover. They exclusively transmit the IMSI during 1) initial connection, that is, when you turn on your smartphone, and 2) upon request by the network. Active IMSI catchers abuse 2). At this stage of early connection setup, the network is not yet authenticated (the IMSI is required for the authentication). Therefore the smartphone must assume the IMSI request comes from the operator network -- and it cannot tell that it's actually a IMSI catcher. Case 1) is obviously pretty rare, so it might be a bit boring to perform IMSI catching on 4G.