How to Detect a Stingray Device: Can You Spot a Cell-Site Simulator?

How to detect a stingray device: the real warning signs, tools like EFF's Rayhunter, the warrant rules for police, and practical ways to cut your exposure.

Short answer: if you want to know how to detect a stingray device, the honest answer is that an ordinary phone cannot reliably tell you. The best public tool right now is the Electronic Frontier Foundation's open-source Rayhunter, which watches for suspicious cell-tower behavior and gives a warning, not proof. This guide covers what stingrays are, what the warning signs really are, the law on police use, and practical steps to cut your exposure.

What a stingray (cell-site simulator) does

"Stingray" is the brand name of one Harris Corporation model that became shorthand for all cell-site simulators, also called IMSI catchers. According to EFF's Street-Level Surveillance guide, the device pretends to be a cell tower. Phones connect to whichever nearby tower looks strongest, so they switch to the simulator. It can then:

Log the IMSI (the SIM card's unique ID) of every phone in range, not just a target's.
Pinpoint a phone's location more precisely than the carrier, without involving the carrier.
If it forces a downgrade to 2G/GSM, potentially intercept call metadata, unencrypted calls and texts, according to EFF and manufacturer marketing materials.

Passive IMSI catchers only listen, and EFF says it is impossible for anyone to know whether a passive IMSI catcher has accessed their phone. Active ones, the kind police mostly use, leave traces in the radio signaling.

How to detect a stingray device: the signs that matter

Online lists of "signs your phone is being tracked" (battery drain, odd noises, slow data) are not reliable. Those symptoms have many everyday causes. The indicators researchers actually use are in the network signaling:

Forced downgrade to 2G when 4G/5G should be available.
A tower requesting your phone's identity (IMSI or IMEI) and then skipping normal authentication.
Missing or odd broadcast messages, such as incomplete System Information Blocks, that real carrier towers send.
Null cipher, meaning the connection is not encrypted.
A short-lived "tower" that appears and vanishes. EFF notes this also happens for innocent reasons, such as temporary towers at big events.

Rayhunter's documentation describes its core red flag as this chain: the phone connects to a new tower, the tower asks for the phone's identity, authentication does not happen, and the tower tells the phone to disconnect.

Tool 1: EFF Rayhunter

EFF launched Rayhunter on March 4, 2025. It was designed to run on the Orbic RC400L mobile hotspot, an inexpensive device, and the community has since added support for some other hardware. It analyzes control traffic and shows a red line or notification when its heuristics fire. It is free and open source on GitHub. EFF is clear that results are heuristic and can include false positives.

Tool 2: Detector apps (use with caution)

Apps such as SnoopSnitch and AIMSICD claim to spot simulators. EFF's 2019 white paper on IMSI catchers found the apps implement different checks, often reach different verdicts on the same tower, and some are unmaintained. Most also need rooted Android phones or specific chipsets.

Tool 3: Research-grade scanners

The University of Washington's SeaGlass project and EFF's "Crocodile Hunter" used software-defined radios to map anomalies across a city over time. That is the most rigorous approach, but it requires radio equipment and expertise.

The law: when can police use one?

On September 3, 2015, the Justice Department issued a policy requiring its agencies, including the FBI, DEA and ATF, to generally obtain a probable-cause search warrant before using a cell-site simulator, plus pen-register authorization. The policy has emergency exceptions and directs agents to delete data on non-targets. The Department of Homeland Security adopted a similar policy weeks later.

Those are agency policies, not a statute, and they do not bind state and local police. Some states require warrants by law; others do not. Many local departments acquired devices under non-disclosure agreements, which is one reason use came to light through court cases and public-records requests rather than official announcements. The Supreme Court's 2018 Carpenter v. United States decision required a warrant for historical cell-site location records from carriers, but it did not directly decide cell-site simulators.

How to reduce your exposure

Turn off 2G. Recent Android versions include an "Allow 2G" toggle in network settings. On iPhone, Lockdown Mode disables 2G support.
Use end-to-end encrypted apps such as Signal for calls and texts. A simulator may still see that your phone is present, but not the content of those messages.
Stop transmitting when it matters. Airplane mode, a powered-off phone or a properly tested signal-blocking (Faraday) pouch prevents a simulator from locating the device while active.
Know what it cannot fix. None of this hides you from carrier records, which are a separate legal question.

If you are building a communications plan that does not depend on cell towers at all, see our guide to off-grid comms with Meshtastic and Baofeng radios, and our explainer on Section 702 surveillance.

Documented, inferred, or unproven?

Documented: federal, state and local agencies use cell-site simulators; DOJ and DHS adopted warrant policies in 2015; the devices collect data from bystanders' phones.

Reasonable inference: use is wider than publicly reported, given non-disclosure agreements.

Unproven: claims that a specific app or a phone's battery behavior proves you are being tracked.

Our view (opinion)

A device that sweeps up every phone around a target is a general search by design. Detection tools are improving, but the stronger protection is law: clear, statutory warrant rules for every level of government, with disclosure in court.

What a detector cannot tell you

Even a good Rayhunter alert has limits. It cannot tell you who operated the device: police, a foreign intelligence service or a criminal with off-the-shelf hardware. It cannot tell you whether your phone was the target or just one of hundreds swept up nearby. And it says nothing about passive catchers or about data your carrier hands over under a court order. If you get repeated alerts in one place, the useful next steps are to note the time and location, save the logs, and share them with researchers such as EFF, which asks users to report findings. For journalists, lawyers and organizers, a lawyer can advise on public-records requests to local agencies about simulator purchases and use policies.

Sources

U.S. Department of Justice, "Policy Guidance: Use of Cell-Site Simulator Technology" (Sept. 3, 2015): justice.gov
DOJ testimony, "Examining Law Enforcement Use of Cell Phone Tracking Devices" (Oct. 21, 2015): justice.gov
EFF, "Meet Rayhunter" (March 2025): eff.org
Rayhunter documentation and heuristics: efforg.github.io/rayhunter
EFF Street-Level Surveillance, "Cell-Site Simulators/IMSI Catchers": sls.eff.org
EFF, "Gotta Catch 'Em All" IMSI catcher white paper (2019): eff.org (PDF)
Carpenter v. United States, 585 U.S. 296 (2018).

Frequently asked questions

How can I detect a stingray device?

There is no reliable sign on an ordinary phone. The most credible consumer tool is EFF's open-source Rayhunter, which runs on a cheap mobile hotspot and flags suspicious tower behavior such as forced 2G downgrades and identity requests without authentication. Its alerts are indicators, not proof.

Do stingray detector apps work?

EFF's 2019 research found that popular detector apps vary widely in quality and often disagree with each other. Some are no longer maintained. Treat app warnings with caution.

Do police need a warrant to use a stingray?

Federal agents under the Justice Department's September 2015 policy generally need a probable-cause warrant, with limited emergency exceptions. Rules for state and local police vary by state.

Does turning on airplane mode stop a stingray?

A phone that is not transmitting cannot be located by a cell-site simulator. Airplane mode or a properly tested signal-blocking bag stops transmissions while active, but you lose service.

Does disabling 2G help against cell-site simulators?

It can. Many attacks rely on forcing a phone onto weaker 2G. Recent Android versions offer a setting to turn off 2G, and iPhone Lockdown Mode disables 2G support.