# MAP-SRI-for-SM — Send-Routing-Info-for-SM, and SS7 SMS security

> MAP-SEND-ROUTING-INFO-FOR-SM (MAP-SRI-for-SM) is the SS7 MAP operation an SMSC sends to a recipient's HLR to ask "where is this subscriber right now, and how do I deliver an SMS to them?" The response includes the IMSI and the serving MSC address — without which no cross-operator SMS can be delivered. It is also, historically, the single most-abused SS7 operation in the world, and the centrepiece of SS7 firewall policy.

- Canonical URL: https://www.broadnet.me/answers/ss7-map-send-routing-info-for-sm
- Language: en
- Last reviewed: 2026-07-22
- Publisher: BroadNet (https://www.broadnet.me)

## What the message does

When an SMSC needs to deliver an MT (mobile-terminated) SMS to a subscriber it does not serve directly, it sends MAP-SRI-for-SM to that subscriber's HLR. The HLR resolves the MSISDN to the current IMSI and the serving MSC's address, returns these to the SMSC, and the SMSC then sends MAP-MT-FORWARD-SHORT-MESSAGE to that MSC for handset delivery. Without SRI-for-SM, there is no cross-operator SMS — every cross-network message in 2G/3G/4G-via-CSFB depends on this query.

## Why it became an attack target

SRI-for-SM is a free location oracle. By querying it against any MSISDN, a sender learns the serving MSC of that subscriber — which is enough to determine which country and which operator the subscriber is currently camped on, and (combined with operator topology data) often the rough geographical region. Repeated queries over time reveal travel patterns. The legitimate SMSC use case requires it; the abuse case is sending repeated SRI-for-SM with no follow-up MT-FORWARD-SHORT-MESSAGE — pure surveillance. SS7 firewalls treat SRI-for-SM as the canonical example for FS.07/FS.11 enforcement.

## What mitigations exist

Four layers. First, the firewall correlates inbound SRI-for-SM with subsequent MT-FORWARD-SHORT-MESSAGE: a peer that asks but never delivers gets reputation-degraded automatically. Second, per-peer rate limits and global thresholds catch bulk-harvesting attempts. Third, GT/PC whitelisting against IR.21-declared roaming partners blocks queries from unauthorised origins. Fourth, anomalous-query alerting (a peer suddenly running 10x its baseline against a specific MSISDN range) pages the SOC for human review. BroadNet's signalling firewall (/operators/ss7-firewall) ships all four behaviours by default and integrates with /platforms/signaling-cdr for cross-event correlation.

## Privacy and compliance considerations

SRI-for-SM responses contain IMSI and serving MSC — both highly sensitive identifiers. PDPL, GDPR, and equivalent regimes all treat location-revealing telecom signalling as protected data, in scope for explicit logging, audit retention, and breach reporting. The defensive frame is universal: log every SRI-for-SM, monitor for anomalies, share reputation data across operators through GSMA-coordinated channels. This entry deliberately does not describe exploit chains — for the operator-side defensive playbook see /answers/gsma-fs07-fs11-signaling-firewall, and for SS7 architectural context see /answers/ss7-map-explained.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [MAP-PSI — Provide-Subscriber-Info, and why it matters for SS7 security](https://www.broadnet.me/answers/ss7-map-provide-subscriber-info)
- [GSMA FS.07 and FS.11 — the SS7 signalling firewall standards](https://www.broadnet.me/answers/gsma-fs07-fs11-signaling-firewall)
- [SS7 MAP — what it is and why messaging still depends on it](https://www.broadnet.me/answers/ss7-map-explained)
- [GT — Global Title in SS7 routing explained](https://www.broadnet.me/answers/ss7-global-title)
- [SS7 Firewall](https://www.broadnet.me/operators/ss7-firewall)
- [Signaling & CDR Intelligence](https://www.broadnet.me/platforms/signaling-cdr)