The GERAN and UTRAN decommissions are part of a global trend. Operators are currently decommissioning legacy infrastructure from their networks. Decommissioning is a phased approach which entails legacy infrastructure is gradually phased out from the network. As GERAN and UTRAN uses weak encryption between the base station and the UE, the communication can be cracked in real time by an attacker to intercept calls or text messages. Known vulnerabilities of GPRS are: one way authentication, GPRS algorithms such as A5/0 (no confidentiality), compromised algorithms A5/1 and A5/2 (GSMA deprecated in 2006), no inherent integrity protection over the air, and authentication and ciphering over the air are optional to implement. In terms of UMTS, known vulnerabilities are: IMSI is still sent in clear text in initial RRC connection request; also, if TMSI is not recognized by the network, then UE is forced to reveal IMSI in clear text, user plane is not integrity protected, messages sent before Security Mode Command (SMC) are not integrity protected, etc. In a scenario where the operator has decommissioned GERAN and UTRAN networks, the UE cannot determine on its own that such radio access networks are no longer available in certain areas. Therefore, if 5G-NR and LTE networks are being blocked by an attacker, the UE can fall back to selecting and connecting to false UTRAN and GERAN base stations. When UE is in an area with no coverage of 5G-NR or LTE, an attacker capable of mounting a false UTRAN/GERAN in the same area will be successful in making the 5G-NR and LTE UE camp on the false UTRAN/GERAN based on the signal strength. Further, in GERAN there is no authentication of the base station to the device, which means that anyone can seamlessly impersonate as a legit GERAN base station. Therefore, if 5G-NR and LTE networks are being blocked by an attacker, a UE can fall back (bid-down) to selecting and connecting to false GERAN/UTRAN base stations.

One such attack scenario is, if the MNO is only 5G-NR operator, then the UE camping on the GERAN Cell Site Simulator (CSS) mounted by an attacker may provide the IMSI in clear, which allows the attacker to bind the UE and the IMSI to track the UE location in the 5G network (if the home network has configured "null-scheme" to be used). Further, UE connecting to a UTRAN or GERAN FBS is vulnerable to bidding down attacks, e.g. fraudulent SMS or phone calls, which could cause significant financial losses for subscribers. The FBS can also make use of a PLMN-ID that is different from the home operator, while at the same time blocking the UE from accessing the home network operator's PLMN. This means, that the radio interface of the UE experiences a roaming scenario without actually moving.

UE and the EPS/5GS should support mechanisms to mitigate bidding down attacks from LTE/NR to decommissioned GERAN/UTRAN by an attacker over the air interface.