What Is a Fake BTS? How Scammers Exploit 2G to Steal OTPs and Passwords, and How to Protect Yourself

SafePhone · Updated September 27, 2026

A fake BTS (fake base station) is a mobile transmitter operated by criminals that pretends to be a carrier's cell tower so nearby phones connect to it. If you receive one-time passwords (OTPs) by SMS for bank transfers, logins, or password resets, you should understand this attack: it exploits weaknesses in the 2G network to send spoofed text messages, inject scam links, and potentially steal OTPs. It's a real-world attack that has been reported in many countries.

Block scam links in text messages with SafePhone

What is 2G, and why does it still exist?

2G (second generation) was the first generation of digital mobile networks, introduced in the 1990s. Compared with the analog 1G networks before it, 2G carried voice and SMS in digital form. 2G was designed mainly for:

• Voice calls
• SMS text messages
• Very slow Internet (GPRS / EDGE)

Compared with today's 4G and 5G networks, 2G has many limitations: very low bandwidth, outdated security, and many weaknesses that have been publicly disclosed and exploited.

Why hasn't 2G disappeared yet?

2G is still kept running in many places because:

• Some people still use older phones.
• Some older IoT devices depend on 2G to work.
• Many rural areas haven't been upgraded yet and rely on existing 2G infrastructure.
• 2G can serve emergencies, such as calling for help where there's no 4G coverage.

This backward compatibility is exactly what creates a serious security hole. Carriers in many countries are shutting down their 2G networks or have already done so. However, most phones still support 2G, so a fake BTS can still broadcast its own 2G signal and lure phones into connecting. Real carriers switching off 2G doesn't mean you're safe.

What is a BTS, and how does it work?

A BTS (Base Transceiver Station) is a cell tower. Whenever you make a call or send an SMS, your phone sends signals to these BTS stations. A BTS is usually mounted somewhere high, such as a rooftop, and covers a specific area.

MS: your phone and SIM

The MS (Mobile Station) is, simply put, your mobile phone plus the SIM inside it. Each MS carries identifiers:

• IMSI: the subscriber identity, tied to the SIM
• IMEI: the device identity, tied to the phone

This information is very important and a frequent target for attackers, which is why devices built to collect IMSIs are called IMSI catchers.

What a BTS does

A BTS acts as the middleman between your phone and the carrier's core network:

• Broadcasts radio signals
• Receives signals from phones
• Manages communication channels
• Broadcasts network information
• Forwards data into the carrier's system

How does a phone connect to a BTS?

1. The phone constantly listens for signals from nearby BTS stations.
2. It automatically picks the station with the strongest signal.
3. It automatically registers with the network.
4. The BTS assigns a communication channel to the phone.
5. You start making calls, sending SMS, and using the Internet.

This is where 2G's biggest weakness lies: phones trust the BTS by default.

Why can fake BTS devices exploit 2G?

In modern 4G/5G networks, the phone and the carrier authenticate each other. In 2G:

This means:

• A fake BTS can copy the parameters and spoof the signal of a legitimate carrier.
• Phones still choose a BTS automatically based on signal strength.
• Phones show almost no information about this process.

Attackers can build or buy fake BTS equipment and broadcast a stronger signal than the real tower so phones connect to it first. Once connected, depending on its setup, a fake BTS can:

• Request your IMSI to identify you as a subscriber without you knowing.
• Force your phone to drop from 4G to 2G without you noticing.
• Read SMS messages containing OTP codes (when the device relays communications as a man-in-the-middle).
• Send spoofed messages that appear to come from another person or brand.
• Send scam SMS containing phishing links.

How does a fake BTS attack work? (overview)

1. The attacker switches on a fake BTS device, often placed in a car, on a motorbike, or in a backpack, and moves through crowded areas.
2. The fake BTS advertises itself as a real carrier tower.
3. Nearby phones detect a strong signal.
4. The phones connect automatically.
5. The fake BTS takes control of the communication.

Depending on the goal, a fake BTS can force phones down from 4G to 2G, disable or weaken encryption, relay data to the real network to eavesdrop, or inject spoofed and phishing SMS.

Warning signs of a fake BTS

Your phone suddenly drops to 2G / “E”

A common sign is a phone on 4G/5G suddenly switching to the “E” (EDGE) or “G” icon. This is suspicious if:

• The area you're in normally has strong 4G/5G coverage, but today you suddenly only see “E”.
• Other devices around you are affected the same way.

Other signs to watch for

• You receive a “branded” message (from a bank, government agency, or carrier) with a link, just as you're in a crowded place like a bus station, shopping mall, or major street.
• Your signal flickers and mobile data drops briefly before returning to normal.
• Many people around you get the same strange message at the same time.

None of these signs proves a fake BTS is present, since a weak signal can have ordinary causes. The safest approach is to never trust any link in an SMS, even if the message shows a familiar name.

How to protect yourself from fake BTS attacks

• Avoid SMS OTPs; switch to TOTP or Smart OTP: authenticator apps like Google Authenticator and Authy, or the Smart OTP feature in your banking app, generate codes right on your device without going over the mobile network, making them far safer than SMS OTPs.
• Turn off 2G support if your phone has this option (see the instructions below).
• Don't log in to important accounts in public places, especially when your signal icon drops to “E”.
• Don't tap suspicious links in SMS. Banks and government agencies don't text you links asking you to log in, update your details, or pay fines. Open the official app yourself or type the web address.
• Check links before opening them: set SafePhone as your default browser so every link is checked against a blocklist before it opens. See how to block scam websites and how to check if a website is a scam.
• Never read your OTP code to anyone, even someone calling who claims to be from your bank or the police. This trick often goes hand in hand with spoofed messages. See advanced scam techniques.

How to turn off 2G on Android and iPhone

Menu names may vary by manufacturer and OS version, and not every phone has this option.

Android

1. Starting with Android 12, some phones (such as Google Pixel) have an Allow 2G toggle: go to Settings → Network & internet → SIMs → turn off Allow 2G.
2. If you don't see this toggle, go to Preferred network type and choose a 4G/5G-only mode if your phone supports it (for example “LTE only”).

iPhone

iOS has no dedicated 2G switch. Starting with iOS 17, Lockdown Mode disables 2G support, but it also restricts many other features, so it's only worth it if you're genuinely worried about being targeted.

What to do if you tapped a link in a spoofed message

1. If you entered a password, card number, or OTP code: immediately call your bank's official hotline (the number on the back of your card) to freeze your account and card.
2. Change the password you entered, plus the password for every account that uses the same one.
3. If you installed an app from the link, uninstall it right away and check its accessibility permissions. See how to spot malicious apps.
4. Report the scam message to your mobile carrier or your country's official scam-reporting service, and report to the police if you've lost money.

Conclusion

A fake BTS exploits the fact that phones trust 2G networks by default. You can't know for sure when you're connected to a fake tower, but you can significantly lower the risk: switch from SMS OTPs to Smart OTP or TOTP, turn off 2G if your phone allows it, and don't tap links in text messages, even ones bearing a familiar brand name. To have scam links blocked before they open, use SafePhone as your default browser.

Check links in your text messages with SafePhone

FAQ