There was a time you could just walk around with a radio receiver and spy on everyone's phonecalls (IMEI stingray). Iirc it's not possible/that easy anymore with LTE.
(Not saying you’re lying, I just want to learn more!)
For GSM, basic IMSI sniffing: https://github.com/Oros42/IMSI-catcher (usable with cheap SDRs)
For LTE, basic IMSI sniffing: https://github.com/JiaoXianjun/LTE-Cell-Scanner (usable with cheap SDRs)
For LTE, full-on sniffing of all unencrypted metadata: https://github.com/SysSec-KAIST/LTESniffer (generally requires fancy SDRs with GPSDO)
Can vouch that the first and second repos definitely worked as of about a year ago, but haven't personally tried since then. I don't have a USRP X310 (yet!) so can't personally speak to the fancy one.
I know my Canadian SIM card somehow hides US providers from network scans, possibly with some geo or if/then rules (but visible from my EU SIM that tries its darnedest to latch onto the US networks and avoid the Canadian ones at all costs)
The way I see it, seems law enforcement agencies using stingrays have a vested interesting in seeing 2G alive and well.