This method may not even be necessary. A safety researcher, Roger Piqueras Jover, learned that 4G / LTE authentication occurs after a mobile phone has already uncovered its IMSI range to an IMSI catcher. In GSM, phones are generally scanning trying to find a tower with a better signal strength https://www.shoghicom.com/all-products/isatphone-pro-monitoring-system