Yea, no, the most likely route is to pickup a MAC address and associate it with an existing assigned IP address (If that device is connected to the public WiFi, but who even does that these days lol), but modern day Android and iOS randomize MAC addresses on every connection these days by default.
And then you’d still need to correlate that to the physical world, most likely route would be detecting Bluetooth hostname, but it’s by no means guaranteed that the device hostname in the public WiFi DHCP table matches the BT one (phones can have different names for each). And again is dependent on the person being connected to store WiFi to begin with. Would also be entirely thwarted of a person’s BT is off which is highly likely
It’s possible, but would be a useless feature to develop and maintain as it would probably actually work out in the real world like maybe 30% of the time.
Unless they shoved a full stingray unit in it or something (extremely unlikely), this is just a statement from someone parroting a sales brochure that they didn’t entirely understand
Actually, no. Phones don’t always broadcast their IMSI. Most of the time they broadcast a Temporary Mobile Subscriber Identity (TMSI) and only on a location update (For power conservation). Your cell provider knows your IMSI already and uses a TMSI for updates for the express purpose of privacy and security for these exact scenarios
It is part of the initial work flow of a Stingray device to attempt to force your device to disconnect from the network and get it to rebroadcast its actual IMSI. But it is not floating around in the air all the time and it certainly isn’t trivial to grab.
BT is really the only viable option, and even that can vary wildly depending on manufacturer.