# SS7 MT-SMS delivery flow, step by step

> Delivering a mobile-terminated SMS over SS7 takes two MAP steps. First the SMSC sends SendRoutingInfoForSM to the recipient's HLR, which returns the IMSI and the serving MSC/SGSN address. Then the SMSC sends MT-ForwardSM to that MSC, which pages the handset and delivers the message, returning the outcome to the SMSC.

- Canonical URL: https://www.broadnet.me/reference/ss7-mt-sms-delivery-flow
- Language: en
- Last updated: 2026-07-18
- Publisher: BroadNet (https://www.broadnet.me)

The full mobile-terminated SMS path over SS7: SMSC to HLR SendRoutingInfoForSM, HLR returns IMSI + serving MSC, SMSC to MSC MT-ForwardSM, paging and delivery, and the absent-subscriber retry via MWD and AlertServiceCentre.

## Step 1 — routing lookup (SRI-SM)

The SMSC starts with only the recipient's MSISDN. It sends a MAP SendRoutingInfoForSM to the HLR that owns that number, addressing the HLR by global title (SSN 6). The HLR looks up the subscriber and, if they are reachable, replies with the IMSI plus locationInfoWithLMSI — the address of the MSC (or SGSN) currently serving the subscriber. This is the routing information the SMSC needs to deliver the message.

## Step 2 — delivery (MT-ForwardSM)

Armed with the serving MSC address, the SMSC sends a MAP MT-ForwardSM to that MSC (SSN 8), carrying the SMS-DELIVER TPDU — the actual message content, originating address and data-coding — inside the MAP parameter. The MSC pages the handset, and on contact delivers the short message over the radio interface. A successful ReturnResult flows back through the MSC to the SMSC.

*The two-phase MT-SMS delivery*

```text
1  SMSC → HLR   MAP sendRoutingInfoForSM { MSISDN, SC address }
2  HLR  → SMSC MAP result { IMSI, servingMSC address }
3  SMSC → MSC  MAP mt-ForwardSM { IMSI, SMS-DELIVER TPDU }
4  MSC  → MS   paging + radio delivery of the short message
5  MSC  → SMSC MAP result (delivered)  →  SMSC generates delivery report
```

## When the subscriber is unreachable

If the handset is off or out of coverage, the MSC returns a MAP error such as absentSubscriber, or the HLR reports the subscriber as unreachable at step 1. The SMSC then stores the message and asks the HLR to set the Message Waiting Data (MWD) flags — the Mobile-station-Not-Reachable and Memory-Capacity-Exceeded flags — via ReportSM-DeliveryStatus. The message stays queued at the SMSC until the subscriber becomes reachable, up to its validity period.

*Common MT-SMS MAP errors*

| Error | Meaning |
|---|---|
| absentSubscriber(SM) | Handset off / out of coverage — set MWD, retry later |
| subscriberBusyForMT-SMS | Subscriber busy handling another MT-SMS — retry |
| sm-DeliveryFailure | Delivery failed (memory full, equipment protocol error…) |
| unknownSubscriber | MSISDN not provisioned on the HLR — terminal failure |
| callBarred | Operator/subscriber barring prevents delivery |

## The retry — Alert and ReadyForSM

When the subscriber reappears — powers on, re-enters coverage, or frees handset memory — the serving MSC/SGSN signals ReadyForSM to the HLR, which consults the MWD list and sends AlertServiceCentre to each waiting SMSC. Each SMSC then repeats the SRI-SM/MT-ForwardSM sequence to deliver the queued message. This alert mechanism is why an SMS sent to a switched-off phone arrives moments after it powers back on.

## Why this flow matters for security

Every step exposes information or trust that can be abused. An SRI-SM sent from a foreign network can extract a subscriber's IMSI and serving-MSC address — the raw material for location tracking and follow-on attacks — without any message being delivered. A spoofed serving-MSC address can redirect MT-SMS, including one-time passcodes, to an attacker. Signalling firewalls therefore screen SRI-SM and MT-ForwardSM by origin, plausibility and velocity.

## Frequently asked questions

### What are the two main steps to deliver an SMS over SS7?

First, SendRoutingInfoForSM: the SMSC asks the recipient's HLR for the IMSI and the address of the MSC currently serving the subscriber. Second, MT-ForwardSM: the SMSC sends the message to that MSC, which pages the handset and delivers it.

### What does the HLR return in the SRI-SM response?

For a reachable subscriber, the HLR returns the IMSI and locationInfoWithLMSI — the address of the serving MSC or SGSN. The SMSC uses that address to target the follow-up MT-ForwardSM. If the subscriber is unreachable, the HLR returns an error instead.

### What happens when I text a phone that is switched off?

Delivery fails with absentSubscriber and the SMSC queues the message, asking the HLR to set the Message Waiting Data flags. When the phone comes back online the MSC sends ReadyForSM, the HLR issues AlertServiceCentre, and the SMSC re-attempts delivery.

### What is Message Waiting Data (MWD)?

MWD is a list the HLR keeps of SMSCs with messages waiting for an unreachable subscriber, together with the MNRF and MCEF flags. It drives the AlertServiceCentre notifications that trigger retry once the subscriber becomes reachable again.

### How can this flow be abused to intercept an OTP?

An attacker who spoofs an UpdateLocation, or supplies a false serving-MSC address, can make the network route MT-SMS — including one-time passcodes — to a node they control. Screening SRI-SM/MT-ForwardSM origin and applying velocity checks is the standard defence.

## Sources

- [3GPP TS 23.040 — SMS technical realization](https://www.3gpp.org/dynareport/23040.htm)
- [3GPP TS 29.002 — MAP (SRI-SM, MT-ForwardSM)](https://www.3gpp.org/dynareport/29002.htm)

## Related

- [MAP operations reference](https://www.broadnet.me/reference/map-operations)
- [TCAP transactions and components](https://www.broadnet.me/reference/tcap-transactions)
- [SS7 security threats & GSMA FS.11](https://www.broadnet.me/reference/ss7-security-threats-fs11)
- [SS7 firewall (operators)](https://www.broadnet.me/operators/ss7-firewall)
- [SMSC gateway (operators)](https://www.broadnet.me/operators/smsc-gateway)