UE finds B26 cell
→ RRC connection established
→ Attach Request sent
→ MME may request IMSI for subscriber identity
→ EPS-AKA authentication
→ MME/eNodeB may request IMEI(SV)
→ UE reports IMEI(SV)
→ Carrier checks equipment database / blacklist
→ Bearer activation and service
