How Carriers Assign Numbers to SIM Cards (HLR/VLR Basics)
Updated:
Phone numbers don’t live “inside” your SIM. They live in a carrier’s databases. This article walks through the life of a number?from national allocation to the exact records in the HLR/HSS (home database) and VLR/MME/AMF (visited/serving node) that make your device reachable for calls and SMS across 2G/3G/4G/5G. Want to confirm what number your device is actually presenting? Try the quick check on our homepage: send an SMS to our gateway and we’ll show the sender MSISDN on the web.
Identifiers 101: ICCID, IMSI, MSISDN?Different Keys, Different Jobs
Three identifiers matter most:
ICCID ? the SIM’s serial number (printed on the card/eSIM profile).
IMSI ? the subscriber ID used for network authentication (lives on the SIM as EFimsi).
MSISDN ? the dialable phone number in the national/International (E.164) plan.
The SIM may include an optional EFmsisdn file, but many operators leave it empty or outdated. Operationally, the binding of “this IMSI uses that MSISDN” is held in the HLR/HSS/UDM, not on the plastic.
From Numbering Plans to Your Line: Allocation → Assignment
Regulators assign E.164 number ranges to operators. Operators subdivide them into internal pools (e.g., postpaid, prepaid, M2M, VIP, quarantine) with policies for cool-off and recycling. When you activate:
The operator selects an available MSISDN from its pool subject to rate plan and geography.
That MSISDN is associated with your subscriber record (IMSI, services, barrings) in the HLR/HSS/UDM.
Optional: write the number into EFmsisdn (not required and often skipped).
In eSIM, SM-DP+ delivers the profile (ICCID/IMSI/keys) to the device. Number assignment remains a core-network operation.
What the HLR/HSS/UDM Actually Stores
At minimum:
IMSI ? MSISDN mapping (one-to-one or one-to-many for twin/secondary numbers).
Service profile: voice/SMS/data entitlements, barrings (ODB), CAMEL/OCS triggers for charging.
Authentication data (Ki/OPc or AKA vectors via AuC/AUSF).
Current location pointer: the serving node (MSC/VLR for CS; SGSN/MME/AMF for PS/EPS/5GS) and roaming status.
In LTE/5G, the HLR evolves into HSS (Diameter) and then UDM (Service-Based Architecture), but the role?“source of truth” for your subscription?remains.
VLR/MME/AMF: Where You Are Right Now
When your device powers on and registers, the network creates a temporary context in a serving node:
2G/3G: VLR (Visited Location Register) paired with an MSC handles circuit-switched mobility; it stores TMSI, LAI, and subscriber capabilities.
4G: MME holds the EPS context (NAS state, security, tracking area list). SMS may use SGs or IMS.
5G: AMF plays the MME-like role; subscriber data comes via UDM/AUSF/UDR.
The HLR/HSS/UDM updates this pointer during Location Update/Attach/Registration. That pointer is exactly how the network knows where to route a call or SMS.
Attach/Registration Flow (Condensed, 2G→5G)
UE selects a PLMN and sends an Attach/Registration request with its IMSI or a temporary ID (TMSI/GUTI/5G-GUTI).
The serving node (MSC/VLR, MME, or AMF) requests authentication vectors from HLR/HSS/AUSF.
Upon success, HLR/HSS/UDM performs Insert Subscriber Data to the serving node and records the UE’s current location.
Data bearers are set up (PDP/EPS PDU/5G PDU). IMS registration (for VoLTE/VoNR/SMSoIP) occurs via P-CSCF/S-CSCF.
ポイント1: The number isn’t needed for radio attach?IMSI and credentials are.
ポイント2: Reachability for calls/SMS depends on the HLR/HSS knowing your current serving node.
Incoming Calls: How the Network Finds You
A call hits the operator’s gateway (GMSC or IMS I-BCF). The gateway asks the HLR/HSS for routing:
CS (2G/3G): GMSC sends SendRoutingInfo; HLR returns an MSRN (temporary route to the MSC). The GMSC forwards the call.
IMS (VoLTE/VoNR): The called MSISDN maps (via ENUM/DNS or internal tables) to an IMPU (tel:/sips:). S-CSCF routes to the UE’s P-CSCF.
If you’ve roamed, the HLR still knows your current MSC/VLR or IMS registration and returns a route there.
Incoming SMS: SRI-SM, SGs, or IP-SM-GW
SMSC queries HLR/HSS with SendRoutingInfoForSM. Depending on access:
2G/3G: HLR returns the MSC/VLR.
LTE (no CS): Delivery via SGs (NAS over MME) or via IP-SM-GW inside IMS.
Wi-Fi Calling: IMS handles SMS over IP when policy allows.
This indirection is why SMS may still arrive when you’re camped on LTE-only or VoWiFi.
MNP (Porting): Keeping the Number, Moving the Home
With Mobile Number Portability, your MSISDN moves to a new operator. The industry uses “All Call Query” or onward-routing databases so that calls/SMS resolve the current HLR/HSS owning your number. Internally, the new operator creates a subscriber record and points the MNP database to it. Old SIM/IMSI authentication no longer works.
MVNO vs MNO: Who Owns the Databases?
Light MVNO: hosted on the MNO’s HLR/HSS; numbering often sub-allocated from the MNO.
Full MVNO: runs its own HLR/HSS/IMS and may hold its own number ranges; it interconnects like an operator.
In both models, assignment is a database operation; SIM files are just credentials.
Edge Cases Power Users Notice
Multiple MSISDN per IMSI: common for secondary lines, “twin cards,” or enterprise services.
Number recycling: inactive MSISDNs return to pools after quarantine; services (RCS/WhatsApp/2FA) may still be bound until re-verified.
EFmsisdn mismatches: the setting in the handset/SIM can disagree with the network’s record; the network wins.
VoWiFi only: you can be reachable on Wi-Fi with no LTE/NR coverage if IMS registration succeeds.
Practical Checks & Self-Diagnostics
On many networks you can:
Use the web tool on our homepage to read back the sender number via SMS.
Look for About Phone → SIM status (Android) or Settings → Phone → My Number (iOS). Treat those as hints, not gospel.
Ask support for the MSISDN tied to your ICCID/IMSI if activation looks odd.
Glossary
E.164: Global numbering format (e.g., +447900123456).
HLR/HSS/UDM: Home databases holding subscriber data and MSISDN?IMSI mappings.
VLR/MME/AMF: Serving nodes tracking your current location/state.
MSRN: Temporary number HLR gives to route CS calls to your current MSC.
Also see our main homepage for the SMS number check tool.
About This Service
This site offers a simple verification tool: you send a one-time code by SMS to a number we provide, and we display?on this website?the phone number that sent it. That helps confirm the MSISDN bound to your SIM/eSIM, which is invaluable when devices or carriers hide it in settings.