Definition
TAC (Tracking Area Code) is the area identifier used for mobility management in LTE/5G networks, planned by the operator. A set of base station cells broadcast the same TAC; when a terminal moves across TACs, it triggers a TAU (Tracking Area Update). LAC (Location Area Code) is the corresponding concept from the 2G/3G era, where the terminal performs a location area update (LAU). IoT SIM cards themselves do not store the current TAC/LAC in a "file" that users can read, but a module can obtain the most recent cell information through AT commands, diagnostic interfaces, or callbacks from registration signaling. If the connection management platform interfaces with operator CDRs, signaling bypass, or GTP probes, it can also observe location area changes reported by the terminal on the core network side.
TAC/LAC change detection refers to monitoring the time series of tracking area/location area for individual SIM cards or device sequences on the platform side. When the change pattern does not match business expectations (for example, a fixed meter suddenly performs TAU across cities, or a warehouse pallet leaves a geofence at an unscheduled time), a risk alert is triggered. This method provides a low-cost, GNSS-free location clue in cellular IoT, with accuracy only at the "area level," but it is sufficient to support the first screening of abnormal movement of a large number of assets.
It should be noted that indoor distribution and ping-pong reselection at boundary cells can cause frequent TAC fluctuations, so the risk control model must introduce time window smoothing and a trusted base station whitelist to reduce false alarms.
Technical key points
Terminal-side acquisition of TAC/LAC depends on module implementation: some modules include tac and lac fields in the CEREG/CGREG query results; readings may lag during sleep or PSM periods. On the core network side, MME/AMF carries the TAI selected by the terminal (including TAC) in TAU/Registration requests, which is a more authoritative source, but obtaining it requires operator cooperation or dedicated network element logs. When IoT SIM cards roam, TAC belongs to the visited network's planning, and cross-border roaming will cause both PLMN and TAC to change simultaneously, so the rules engine needs to make a combined judgment.
For multi-mode terminals switching between 4G/5G, the mapping between TAC and NCGI changes, and the platform should unify it into the reference system used for the geofencing service. eUICC profile changes may lead to a preferred RAT change, which can alter TAC sampling frequency and easily be misjudged as an anomaly, so alarms should be suppressed during SIM change events.
Compared with pure IP positioning, TAC/LAC are not exposed in public network messages, providing relatively better anti-counterfeiting, but it still cannot prevent professional attackers from injecting false reports into the module firmware. For critical scenarios, cross-verification with GNSS or short-range positioning is recommended.
IoT SIM cards and platform configuration
SIM providers can open APIs to push a summary of "latest TAU time and TAI" or provide export options in connection management portals. On the platform side, it is recommended to maintain, for each IoT SIM card, a sliding window of TAC sequences, statistics of intervals between adjacent switches, and a geographic mapping table (provided by operator engineering references or third-party libraries). Rules can be configured: maximum unique TAC values per day, a list of prohibited inter-provincial TACs, and exemption periods linked to planned work orders.
For customers using VPDN or private network APN, signaling mirroring can be done in parallel on the gateway side to reduce the difficulty of interfacing with public network operators. Bulk devices should unify the firmware version to ensure consistent TAC reading interfaces and avoid monitoring gaps caused by some models lacking this field.
Data retention periods must meet auditing requirements while also complying with personal information protection laws: if the TAC can indirectly identify personal movement, the processing purpose and retention period should be stated in the privacy policy.
Operation and Troubleshooting
When false alarms occur frequently, check whether the operator has optimized the TAC boundaries, causing a group of devices to simultaneously perform TAU; whether there is a module firmware bug that causes incorrect TAC reports. Missed reports may be due to too long a platform sampling cycle, missing short-term cross-region movements that return to the original area; polling can be shortened or cell information can be attached when business packets are sent.
For cases of 'SIM card theft and disassembly', the relationship between ICCID and device certificates can be compared; if the TAC changes drastically and the certificate does not match, the risk score should be raised. If the customer reports inaccurate positioning, clearly inform them that the TAC only provides regional-level clues and cannot replace law enforcement-level precise positioning.
When conducting joint analysis with operators, providing the precise time period and the last six digits of the IMSI can narrow down the log search range and shorten MTTR.
Compliance and Security
When using TAC/LAC for employees or consumer terminals, a personal information impact assessment must be completed, access permissions and de-identified display should be restricted. Cross-border card roaming data may pass through operators in multiple countries, and contracts should stipulate log ownership and retrieval procedures. Using cellular location clues in financial risk control should comply with the requirements of regulators such as the People's Bank regarding auxiliary information for transaction verification.
When sharing TAC history with external partners, fields should be minimized and a data processing agreement should be signed to prevent unauthorized profiling.
Use Cases
Leased device anti-tamper and anti-theft, abnormal departure of logistics pallets, monitoring of asset migration for EV charging stations and battery swap cabinets, and deployment of high-value industrial gateways can all use TAC/LAC changes as a low-cost risk control layer. Anti-theft for smart city facilities can enable this strategy on NB devices without GPS modules. Insurance companies can also use it as an auxiliary evidence chain for claim verification.
SimtoLink provides practical templates for connecting IoT SIM card data to platform risk control modules, helping clients enhance asset visibility without significant hardware changes.