Voice over Wi-Fi, or VoWiFi, is not a separate calling service. It is the same carrier voice system reached by a different road. Carriers moved voice off dedicated circuits and onto an IP core years ago, which is what VoLTE calling is. Wi-Fi Calling reuses that same core and lets the handset arrive over any internet connection instead of over the radio network.
The consequence is that your phone number, your voicemail, your call records and your billing all behave normally. The call is a carrier call in every respect that shows up on a bill. Only the first hop changed.
What the handset actually builds
The bridge between the open internet and the carrier's voice core is a gateway called the ePDG, the Evolved Packet Data Gateway. Your phone has to find it, and it does so from the SIM. The hostname is derived mechanically from the mobile country code and mobile network code burned into your SIM profile, in the form epdg.epc.mnc<MNC>.mcc<MCC>.pub.3gppnetwork.org. There is no configuration for you to enter, because the SIM already says which carrier you belong to.
The phone then negotiates an IKEv2 session with that gateway and authenticates using EAP-AKA (RFC 4187), which challenges the shared secret stored on the SIM. No password, no certificate you manage, no account login. The SIM is the credential, which is the same property that makes SIM swapping so effective against everything else that trusts a phone number.
What comes out of that negotiation is an IPsec tunnel from the handset to the carrier's gateway, typically on UDP 500 and UDP 4500. SIP signalling and RTP audio ride inside it. From the perspective of the network you are borrowing, that is the entire visible transaction.
What the local network learns
Suppose the network is a hotel, a conference venue, or an employer. What that operator can see is a device joining, a DNS lookup for a hostname that names your carrier, and then a steady IKEv2 and IPsec flow to that carrier's gateway address. Traffic volume and timing follow your speech, so call start, call end and duration are all readable from the outside of the tunnel.
What the operator does not get is the number you dialled or the audio. Those are inside the tunnel. The DNS lookup, though, is worth thinking about, because it announces which carrier you use to whoever runs the resolver. That is an identity signal, not a content one, and it survives even if the call never connects.
The tunnel protects your call from the network you are borrowing. It does not protect your call from your carrier, because the carrier is the party that terminates the tunnel and decrypts what is inside it.
What the carrier gains that it did not have before
Your carrier already held your call detail records: who you called, when, and for how long. Wi-Fi Calling does not change that. What it adds is the public IP address of whatever network you connected from, recorded against each call.
On the cellular path, the location signal in the record is a cell site. Over Wi-Fi it becomes an IP address, and IP addresses map to premises rather than to coverage areas. Your home connection, your employer, the hotel you stayed in, the coffee shop, the VPN exit you happened to be using. That is a different and often sharper location trail than the cellular one, produced as a side effect of a feature you enabled to fix a coverage problem.
There is a jurisdictional consequence too. The tunnel terminates at your home carrier's gateway. Standing in another country with Wi-Fi Calling active, your voice traffic leaves the country you are in and surfaces inside your carrier's country, under that country's interception rules. Some travellers want exactly that. Others assume the opposite is happening.
Emergency calling is the awkward part
A cellular network locates an emergency caller by the tower that carried the call. Over Wi-Fi there is no tower. Regulators handled this by requiring carriers to collect a registered emergency address, which is the form you filled in when you first enabled the feature and then forgot about.
Carry the handset somewhere else, place an emergency call over Wi-Fi, and dispatch may receive the address you registered rather than where you are. Current handsets supplement this with device-based location, and the picture has improved, but the registered address is still in the loop and the failure is quiet. If you enabled Wi-Fi Calling at an address you have since moved out of, that field is stale right now.
You cannot inspect the crypto
The IKEv2 proposal, the cipher suites offered, the Diffie-Hellman group, the rekeying interval: all of it is chosen by the carrier and negotiated by firmware. Academic surveys of deployed VoWiFi configurations have repeatedly found operators still offering deprecated parameters, and there is no way for a subscriber to check. The settings screen has one toggle on it, and the toggle reports whether the feature is on, not whether the tunnel is any good.
This is a general property of carrier features rather than a specific accusation. Compare it to a messaging protocol published as an open specification, where the parameters are in a document anyone can read and the client is software you can examine. With VoWiFi the security depends on decisions made by a party you cannot audit, on a schedule you are not told about.
Who learns what
| Party | Learns | Does not learn |
|---|---|---|
| Local network operator | That you connected, which carrier you use (from DNS), call timing and duration from flow patterns | Dialled number, audio |
| Anyone tapping that network | The same as the operator | Dialled number, audio |
| Your carrier | Dialled number, duration, the audio itself, plus your access IP address for every call | Nothing new is hidden from it |
| Your carrier's government | Whatever the carrier holds, under that country's process, regardless of where you were standing | Nothing the carrier does not hold |
What to do with this
Wi-Fi Calling solves the problem it was designed for. If your building has no signal and you need your normal phone number to work, it is the right tool and the tunnel genuinely protects the call from the network you are sitting on. Leaving it enabled at home is a reasonable default.
It is the wrong tool if the party you are trying to keep out of your calls is the carrier or anyone who can serve the carrier with legal process. The tunnel ends at their gateway. Feeding it your access IP address on every call makes that record more revealing than the cellular equivalent, not less. For that threat model the answer is an end-to-end encrypted voice application over the same Wi-Fi, where the operator holds ciphertext and no phone number is involved.
Two smaller adjustments are worth making. Check the registered emergency address if you have moved, because nothing prompts you to. And if you do not want to advertise your carrier to a network you distrust, turning the feature off before you join is the only control you have, since the ePDG lookup happens on its own.
The general pattern here shows up across mobile features. A convenience is added at the edge, the cryptography is real, and the trust boundary quietly moves rather than disappearing. Knowing which party sits at the far end of the tunnel tells you most of what you need. For the adjacent version of this question on the cellular side, see 5G subscriber privacy and IMSI catchers.