# MAP-PSI — Provide-Subscriber-Info, and why it matters for SS7 security

> MAP-PROVIDE-SUBSCRIBER-INFO (MAP-PSI) is an SS7 MAP operation that lets one network element query another for subscriber state — typically the serving MSC, the current location (Cell-ID and LAI), and the IMEI. It was designed for legitimate inter-operator uses (roaming partner queries, lawful intercept, network-internal services), but it became one of the canonical SS7 attack-surface operations and is now tightly controlled by SS7 signalling firewalls.

- Canonical URL: https://www.broadnet.me/answers/ss7-map-provide-subscriber-info
- Language: en
- Last reviewed: 2026-05-28
- Publisher: BroadNet (https://www.broadnet.me)

## What the message does

MAP-PSI is invoked by an SCP, a VLR, or an HLR against another network element to retrieve current subscriber state. The response includes location information (LAI, Cell-ID, geographical coordinates if available), the IMEI of the device currently registered, the call-forwarding state, and the active subscription services. In a healthy operator-internal use case (e.g. an SCP needing to know where a subscriber is to apply geo-policy), MAP-PSI is fast, accurate, and useful.

## Why it became an attack target

Without firewall protection, an attacker with SS7 access (rented from a grey-market provider, abused through a complicit small operator, or stolen via leased signalling) could send MAP-PSI against any MSISDN from any peer and get back precise location and device data. This was the root mechanism behind a wave of high-profile location-tracking and lawful-intercept-abuse incidents in the 2010s. The defensive response: classify MAP-PSI as GSMA FS.07 Category 2 — only acceptable from confirmed roaming partners — and drop everything else.

## What mitigations exist

Three layered defences. First, the SS7 firewall enforces per-peer GT/PC whitelisting and FS.07 categorisation, dropping MAP-PSI from any non-roaming-partner peer. Second, rate-limiting and reputation scoring catch even authorised peers abusing the operation (a roaming partner suddenly running 100x more PSI queries than baseline gets throttled and the operator's NOC is paged). Third, cross-operator threat-intelligence sharing through GSMA T-FCS lets operators block sources that have abused PSI elsewhere. BroadNet's SS7 firewall (/operators/ss7-firewall) ships all three layers preconfigured.

## Privacy and compliance considerations

Subscriber location is one of the highest-sensitivity data classes under every modern privacy regime — EU GDPR Article 9 special-category-adjacent, KSA PDPL strict-purpose-limited, UAE Federal Data Protection Law restricted. Operators must log every MAP-PSI received and every response sent, with audit retention and access control. GSMA FS.11 is the monitoring spec that operationalises this. Educational note: this entry describes the defensive frame — what to monitor and how to block — not the offensive technique. For exploit detail, see GSMA's restricted-distribution documentation.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [MAP-SRI-for-SM — Send-Routing-Info-for-SM, and SS7 SMS security](https://www.broadnet.me/answers/ss7-map-send-routing-info-for-sm)
- [GSMA FS.07 and FS.11 — the SS7 signalling firewall standards](https://www.broadnet.me/answers/gsma-fs07-fs11-signaling-firewall)
- [SS7 MAP — what it is and why messaging still depends on it](https://www.broadnet.me/answers/ss7-map-explained)
- [SIGTRAN — SS7 over IP explained](https://www.broadnet.me/answers/what-is-sigtran)
- [SS7 Firewall](https://www.broadnet.me/operators/ss7-firewall)
- [Signaling & CDR Intelligence](https://www.broadnet.me/platforms/signaling-cdr)