Master Subsidy Lock (MSL) Codes

Introduction
————

Wireless telephone providers often subsidize the cost of the handsets that are used on their system. The price that you pay for the phone is often less than the price that the provider paid the manufacturer for the same phone. This practice can easily be seen when a wireless reseller is giving away free phones.

How can this happen? Well, the wireless provider can implement a combination of either one or two methods in order to recoup their susbidy interest in your phone.

First of all, most wireless providers require that in order to receive post-paid service, you must sign a contract, typically one year in length. This ensures that the wireless provider will receive revenue for the term of the contract, and thus, will pay off the subsidy interest in the phone.

How does the provider recoup the subsidy if you did not sign a contract, or if you are using pre-paid service? In this case, the carrier usually implements some sort of subsidy lock on the telephone. This subsidy lock is a numeric code known only to the service provider, and must be known in order to program the mobile telephone number (MTN) into the phone. CDMA phones typically refer to this code as the 'master subsidy lock code', a 'programming code', or a 'sublock code'.

TDMA IS-136 phones use a 'SOC lock' to make the phone search for signals broadcasting a particular service operator code. GSM phones use a 'SIM lock' or 'SP lock' in order to prevent the use of SIM cards from competing providers in their handsets. Once the SIM lock code is entered into a GSM handset, the phone is unlocked and can be used with any provider's SIM card.

Since the master subsidy lock code is needed every time a CDMA phone is reprogrammed, it makes it possible for a wireless provider to ensure that the phone will only generate revenue on their network, and not on a similar, competing network. No other provider will know the code for the phone, and hence, will not be able to program the phone to work on their service.

Subsidized GSM phones work in a similar manner. In this case, the phone will only recognize SIM cards of that particular wireless provider. SIM cards from other providers are rejected, and will not work in the phone until the unique SIM unlock code is entered into the handset.

GSM SIM unlock codes
———————-

GSM phones have an 8-digit code (BlackBerry uses a 16-digit code) used to unlock the the phone to the service provider. Once the code is entered, the phone is permanently unlocked and is capable of using any SIM card.

The easiest way to get the SIM unlock code from your provider is to tell them that you are traveling someplace internationally where they have no roaming agreement in place. (United States residents; these countries are Iran, Syria, or any other place where there are no normal diplomatic relations.) Tell them that you need to use your phone while away, but will need to purchase a foreign prepaid SIM card since the phone will not roam, and need the SIM unlock code in order to use aforementioned prepaid SIM card.

As long as you are under contract, the provider will most likely give the SIM unlock code to you. You will need to give them the IMEI (serial number) of your phone, as the unlock code is unique to each IMEI. The IMEI is most likely located under the phone's battery, or printed on the side of the box the phone came in, if you still have it. Give the IMEI to your provider's customer service agent, and then they will be able to look up the SIM unlock code for your phone.

Power off your cell phone, remove the existing SIM card, and insert the new SIM card. Power the phone back on, and it should prompt you to enter the SIM unlock code. Enter the SIM unlock code, and the phone should now be permanently unlocked, and ready to take any SIM card.

CDMA SPC and MSL codes
———————-

CDMA phones can have two six-digit codes; a one-time service programming code (SPC), and the master subsidy lock (MSL). The SPC is can be used to activate a brand new phone onto wireless service, and it works only one time. Not all wireless carriers use the SPC code.

The SPC makes it possible for a consumer to purchase the phone anywhere, call up the provider's toll-free number, and then activate the wireless phone from the directions given by the representative on the other end of the line. After the initial programming, the SPC is no longer valid. This method enables the initial field programming of the phone by the consumer, and now the wireless provider has the knowledge of the only working programming code for your phone for subsequent programming, which is the master subsidy lock.

Once the SPC has been used, the only working programming code for the phone is the MSL. This fact is important to note, because if the phone needs to be reprogrammed for any reason, the MSL must be used. These reasons may include a phone number change, a PRL update, or a firmware upgrade.

For example, if you need to change your phone number because you moved, or perhaps, you purchased the phone second-hand, the phone must be reprogrammed, and to do so requires knowledge of the MSL.

The MSL code is generated by an algorithm based upon the phone's ESN and the specific carrier who originally sold the phone. Each carrier uses a different algorithm to create the MSL code. For example, one carrier would not be able to generate valid MSL codes for a different carrier's cellular phone simply by plugging in the phone's ESN into their algorithm.

NOTE: Be careful when purchasing a second-hand phone, especially from places like eBay. Some wireless carriers, including Sprint PCS, nTelos, and Qwest/US West will NOT activate a phone if it is associated with an account with an outstanding balance. If this is the case, they will not release the MSL, and thus, you will have purchased a paperweight. If you intend to purhcase a second-hand phone for use on one of these carriers, ask the seller for the ESN of the phone and check with the carrier to see if the ESN is clear before completing the transaction.

http://groups.google.com/groups?q=sprint+qualcomm+esn&num=100&hl=en&lr=&safe=off&rnum=11&ic=1&selm=3801c042.130128937%40news-server.tampabay.rr.com

http://groups.google.com/group/alt.cellular.sprintpcs/browse_thread/thread/301167788d268075?hl=en&q=sprint+qualcomm+esn&pli=1

How do I get the MSL for my phone?
———————————-

Remember that once the SPC is used, the only valid programming code is the MSL, right? Well, the general idea behind social engineering the MSL out of the wireless provider is to find a reason to reprogram your phone.

For your convenience, I have created the following scenarios which will involve use of the MSL:

1. You would like to obtain the MSL for your Sprint PCS wireless telephone. Sprint PCS has made this process easier by implementing their online activation system athttp://activate.sprintpcs.com This website makes it possible for a Sprint PCS customer to change the phone associated with their account without interacting with a customer service representative. All you need to do is login to the site, and enter the ESN of the phone you wish to activate onto your account. The site will give you detailed instructions on how to reprogram your wireless telephone number into the phone you are trying to activate, and in the process will give the end user the programming code. There should be an option during the activation process which asks if the phone is brand new, or has been previously activated. Be sure to select the previously activated option as only then will the activation website give you the master subsidy lock code. If the brand new phone option is selected, then the activation website will only give you the one-time programming (SPC) code.

2. You have purchased a used nTelos Motorola StarTac 7868W with no outstanding balance from eBay and would like to activate this phone on Alltel. First, you will need to call nTelos in order to obtain the MSL. Tell them that you would like to sign up for wireless service which does not require a contract. This may be either pre-paid or post-paid service. Most likely, you will want to ask for the cheapest plan possible, because you really don't want to continue service with them, you just want the code. They will begin to set up an account and telephone number for you, and will most likely guide you through the programming instructions over the phone. At some point during their instructions, they will give you a six-digit code, which of course, is the MSL. You can be assured that this code is the MSL, because the phone is used, and the SPC no longer works.

3. Your Sprint PCS Motorola Timeport P8167 needs a PRL update. You will need to take your phone to a Sprint PCS service location, where they will have the necessary equipment to perform this procedure. Inform the sales associate at the front counter that you would like a PRL update in your phone. Most likely, the sales associate will first check in the computer and write down a six-digit number on a post-it note. Be sure to look at the number that he is writing down, because it is the MSL! In order to update the PRL in the phone, the service software in the computer will prompt the technician for the MSL, and this is why the sales associate has written it down for him.

Reprogramming your wireless telephone
————————————-

Once you have the unique MSL for your CDMA wireless telephone, you can now begin to program the NAM so you can use your phone for your new wireless service. You will need to follow whatever programming steps are necessary for your phone to enter your mobile telephone number (MTN) and your home system ID (SID).

IMPORTANT – Before programming your phone, you must be certain that the phone you wish to program will operate in the wireless band that your provider operates.

For example, a dual-mode CDMA800/AMPS MHz phone will only operate in the 800 MHz cellular band; a dual-mode, dual-band CDMA1900/AMPS phone will only operate digitally in the 1900 MHz PCS band, and analog in the 800 MHz cellular band; and a tri-mode CDMA1900/CDMA800/AMPS phone will operate with all CDMA providers.

Updating the PRL file
———————

Once the NAM is programmed, you WILL HAVE to update the PRL, or preferred roaming list. The PRL is a binary file used only by CDMA phones, and is necessary to tell the phone what cellular towers to use. This file follows the TIA/EIA IS-683A specification. Without a PRL update, the phone will continue to search for the towers of the previous provider that the phone was used with, and not the provider that you wish to use.

Many providers, including Verizon Wireless, support over-the-air (OTA) programming of PRL files. To accomplish this task, you need to know what band your provider is operating on in your area. Is your provider operating in the 800 MHz cellular bands, or in the PCS 1900 MHz bands?

First, you will need to contact your service provider in order for them to put the ESN of the phone you are trying to activate onto your account. The phone will then be ready for OTA programming, as the provider's OTA platform will need to know the ESN of the phone that needs to be programmed.

Try the following *2280x activation codes until you reach a message belonging to the provider you wish to use.

*22800 A-side 800 MHz
*22801 B-side 800 MHz
*22802 PCS A-block 1900 MHz
*22803 PCS B-block 1900 MHz
*22804 PCS C-block 1900 MHz
*22805 PCS D-block 1900 MHz
*22806 PCS E-block 1900 MHz
*22807 PCS F-block 1900 MHz

IMPORTANT – The phone must be able to receive a CDMA digital signal in order to update the PRL file OTA. The PRL file cannot be updated with an analog AMPS signal.

The above codes force the phone to utilize the towers of the provider using the specific frequency in your area, and are used to program your phone with that provider's network.

If you are trying to program your phone for use on Verizon Wireless, upon dialing the appropriate *2280x code, you will hear voice prompts to program your phone. One option will be to program your mobile telephone number; a different option will be to update your roaming capabilities, which will update your PRL file. These options can be used accordingly in order to activate the phone on the appropriate network.

Please note that OTA programming requires the provider's knowledge of the phone's master subsidy lock (MSL) code. Sprint PCS, Qwest, PrimeCo, and other CDMA providers who use subsidy locked phones transmit the MSL code during the OTA process. Verizon Wireless assumes that the phone is not subsidy locked, and programs the phone regardless.

If you are trying to use a phone with a subsidy lock code other than 000000, the Verizon Wireless OTA platform will not be able to OTA program your phone. A lock code of 000000 effectively means that the phone is unlocked, as the phone will not prompt the user for a programming code when the current code is set to 000000. You will need to enter the advanced programming menu of your phone and reset the subsidy lock code to 000000 so that the OTA platform will be able to program your phone.

Once your phone is loaded with a PRL from the provider you wish to use, you can periodically dial *228 to obtain an updated PRL if one is available.

Q&A
—

Q. My phone has never been activated before. Can I use the one-time service programming code to change the master subsidy lock?

A. Users of the Nokia 6185 have reported that they have sucessfully changed the master subsidy lock by using the one-time code. In the *3001#12345# programming sequence, there is an option labled 'Change SPC'. In order to utilize this function, knowledge of the current SPC is needed. As long as the one-time code has never been used before, it can be used in this case to change the master subsidy lock. Make sure that you write down the new code in a safe place, as it will be the only code that will be able to program the phone, and the MSL stored in the wireless provider's database will no longer be valid. A good idea would be to change the SPC to six zeros (000000).

Q. Can I use any CDMA1900 capable phone on Sprint PCS?

A. In general, the answer is no. The accounting system used by Sprint PCS will only recognize ESNs of phones that are originally designed for use on the Sprint PCS network. For example, even though SPCS uses the Nokia 6185 and Motorola ST7867W, it is NOT possible to use either of these phones if they were not originally labeled as SPCS phones.

While it is not possible to use a non-SPCS phone within SPCS's database, it is quite possible to activate such a phone with one of SPCS partner systems. A reader of this page has informed me that he has sucessfully activated a non-SPCS Nokia 6185 on Via Wireless, a SPCS partner system. His goal was to have a dual-NAM Nokia 6185 with the minibrowser on SPCS, so he could also use the same phone on Verizon Wireless. Since the SPCS Nokia 6185 has only one NAM, he had to purchase a dual-NAM Alltel Nokia 6185 with the minibrowser firmware, and he is sucessfully using SPCS/Via service on NAM1, and Verizon Wireless service on NAM2. I would assume that this technique is also possible on other SPCS partner systems.

CDMA wireless phones
——————–

Below is a listing of the phones offered by various CDMA carriers. Carriers which operate in the 800MHz cellular band are denoted as CDMA800/AMPS, and carriers which operate in the PCS band are denoted as CDMA1900.

Verizon Wireless and Alltel operate in the cellular and PCS bands, and require a tri-mode CDMA1900/CDMA800/AMPS capable phone. Sprint PCS, nTelos, Qwest, PrimeCo, Surewest Wireless, Cricket, and Metro PCS operate solely in the PCS band and only require CDMA1900 capability.

An asterisk denotes that this particular phone has been discontinued by the carrier. Phones common to different carriers should be easy to activate on a different carrier, provided that the MSL for the phone is known.

Please note that while it may be possible to use a Sprint PCS phone on a similar system, only Sprint PCS phones can be used on Sprint PCS, as their accounting software will not recognize the ESN of any phone not initially sold by them. Not all Sprint phones can be activated on another system; please see note below.

nTelos http://www.ntelos.com – CDMA1900
—————————————
Audiovox PCX1100XL CDMA1900
Kyocera/Qualcomm QCP-2760 CDMA1900
Kyocera/Qualcomm QCP-2035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-3035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-6035 CDMA1900/CDMA800/AMPS
LG SP-110 CDMA1900
Motorola StarTAC ST7868W CDMA1900/CDMA800/AMPS
Nokia 5185i CDMA1900/CDMA800/AMPS

SprintPCS http://www.sprintpcs.com – CDMA1900
———————————————
Denso Touchpoint 2100 CDMA1900/AMPS
Denso Touchpoint 2200 CDMA1900/AMPS
Kyocera/Qualcomm QCP-1920 CDMA1900 *
Kyocera/Qualcomm QCP-1960 CDMA1900 *
Kyocera/Qualcomm QCP-2760 CDMA1900/AMPS
Kyocera/Qualcomm QCP-2035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-2255 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-3035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-6035 CDMA1900/CDMA800/AMPS
LG Touchpoint 1100 CDMA1900
Motorola StarTAC ST7867W CDMA1900/AMPS (1) *
Motorola StarTAC ST7762 CDMA1900/AMPS (1) *
Motorola Talkabout T8167 CDMA1900/AMPS (1) *
Motorola Talkabout T8367 CDMA1900/CDMA800/AMPS *
Motorola Timeport P8167 CDMA1900/AMPS (1) *
Motorola Timeport P8767 CDMA1900/CDMA800/AMPS
Motorola V.8162 CDMA1900
Neopoint NP1000 CDMA1900
Nokia 6185 CDMA1900/CDMA800/AMPS *
Nokia 5170 CDMA1900 *
Nokia 2170 CDMA1900 *
Samsung SCH-3500 CDMA1900/AMPS (1)
Samsung SCH-6100 CDMA1900
Samsung SCH-8500 CDMA1900/AMPS (1)
Samsung SPH-N200 CDMA1900/AMPS (1)
Samsung SPH-N400 CDMA1900/CDMA800/AMPS
Samsung M100 Uproar CDMA1900/AMPS (1)
Sanyo SCP-4500 CDMA1900/AMPS
Sanyo SCP-5000 CDMA1900/AMPS
Sanyo SCP-6000 CDMA1900
Touchpoint 3000 CDMA1900

Qwest/US West http://www.uswestwireless.com – CDMA1900
——————————————————
Kyocera/Qualcomm QCP-2035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-3035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-6035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-1960 CDMA1900 *
Kyocera/Qualcomm QCP-2760 CDMA1900/AMPS *
Motorola StarTAC ST7867W CDMA1900/AMPS (1) *
Nokia 3285 CDMA1900/CDMA800/AMPS
Nokia 6185 CDMA1900/CDMA800/AMPS *
Nokia 5185i CDMA1900/CDMA800/AMPS
Nokia 5170 CDMA1900 *

PrimeCo PCS (non-Verizon systems in Chicago & Houston)
*22803 to activate OTA on US Cellular/PrimeCo in Chicago
——————————————————–
Audiovox PCX1100XL CDMA1900
Audiovox PCX3500XL CDMA1900
Audiovox PCX1000XL CDMA1900 *
Kyocera/Qualcomm QCP-1920 CDMA1900 *
Kyocera/Qualcomm QCP-1960 CDMA1900
Kyocera/Qualcomm QCP-2700 CDMA1900/AMPS *
Motorola StarTAC ST7762 CDMA1900/AMPS *
Nokia 6185 CDMA1900/CDMA800/AMPS *
Nokia 2170 CDMA1900 *
Sony 2200/3200 CDMA1900/AMPS *

Alltel http://www.alltel.com – CDMA1900/CDMA800/AMPS
—————————————————-
Audiovox 8000 CDMA1900/CDMA800/AMPS *
Kyocera/Qualcomm QCP-2035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-6035 CDMA1900/CDMA800/AMPS
Motorola Timeport 270c CDMA1900/CDMA800/AMPS
Motorola V60c CDMA1900/CDMA800/AMPS
Motorola StarTAC ST7868W CDMA1900/CDMA800/AMPS
Nokia 5185i CDMA1900/CDMA800/AMPS
Nokia 6185 CDMA1900/CDMA800/AMPS

Verizon Wireless http://www.verizonwireless.com – CDMA1900/CDMA800/AMPS
———————————————————————–
Audiovox CDM9000 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-2035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-2135 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-2235 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-3035 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-6035 CDMA1900/CDMA800/AMPS
LG V111 CDMA800/AMPS
Motorola StarTAC ST7868W CDMA1900/CDMA800/AMPS
Motorola Timeport P8767 CDMA1900/CDMA800/AMPS
Motorola Timeport 270c CDMA1900/CDMA800/AMPS
Motorola V120c CDMA1900/CDMA800/AMPS
Motorola V60c CDMA1900/CDMA800/AMPS
Motorola V60i CDMA1900/CDMA800/AMPS
Motorola V2260 CDMA800/AMPS
Motorola Vulcan V8160 CDMA800/AMPS
Nokia 5185i CDMA1900/CDMA800/AMPS

SureWest Wireless http://www.surewestwireless.com – CDMA1900
————————————————————-
Kyocera/Qualcomm QCP-2235 CDMA1900/CDMA800/AMPS
Kyocera/Qualcomm QCP-3035 CDMA1900/CDMA800/AMPS
Motorola StarTAC ST7868W CDMA1900/CDMA800/AMPS
Motorola V120c CDMA1900/CDMA800/AMPS
Motorola V60c CDMA1900/CDMA800/AMPS
Nokia 5185i CDMA1900/CDMA800/AMPS
Nokia 8270 CDMA1900

Cricket Commumications http://www.cricketcommunications.com – CDMA1900
———————————————————————–

metroPCS http://www.metropcs.com – CDMA1900
——————————————–
Kyocera/Qualcomm QCP-2235 CDMA1900/CDMA800/AMPS
SonyEricsson T206

(1) These phones may be used on Verizon Wireless and Alltel only in areas where the home system is a CDMA1900 system. Specifically, this includes all Verizon/PrimeCo systems, and where ever Alltel has CDMA1900 systems installed (Jacksonville, FL comes to mind). Please note that you will be roaming analog on non-home Verizon Wireless and Alltel systems as these phones are not capable of CDMA800. (Can someone let me know if a tri-mode, dual-band PRL will work in a dual-mode, dual-band phone? I see no reason why this should not work, and hence, everything I have said above should still be valid. please let me know. tks.)

http://bridog.net/cellular/master-subsidy-lock-msl-codes/