The problem here is that the phone is connected to your network instead of the provider's network. To the eyes of the provider the phone is offline.
What you need to try and do is instead downgrade the phone's connection to the provider to a bad enough encryption that you can crack. I would first start with jamming the strong encryption bands like 3G and 4G/LTE, and go from there.
Another option is to proxy the phone's connection to the provider through your fake BTS. I am not sure if it's possible but the idea is that your BTS appears as a phone to the provider's network while appearing as the provider to the phone, and proxies everything in between (while logging it). I'm not that familiar with how GSM encryption works and whether it's possible to become a man-in-the-middle this way. You'd most likely have to write custom code to do this.
Finally another option is to hijack calls/texts through SS7. This requires an active connection to the global SS7 network, and then you basically say to the provider "hey I'm one of your roaming partners and your customer just connected to our network" and the provider's network will now send you all their calls. You don't even need to have the phone or the SIM, and you can do that with any mobile provided you know their IMEI and IMSI. This works even if the phone is still on their network. You would guess the network infrastructure is smart enough to realize that a phone attached to their BTS can't be roaming at another provider and it's probably an attacker doing nasty things, but the idiots at Ericsson, Alcatel & co thought otherwise.
Obviously the last option is probably illegal unless you have permission from the carrier which you'll probably never get, because 1) scamming customers is more important so why waste time on this and 2) the network infrastructure is so fragile that even benign stuff can bring the whole network down and they obviously don't want that. For example see the Telenor incident where a totally unrelated pentest in a different country crashed their HLR (and thus brought down the entire network) for several hours :
– The analysis reveals that at the time of the crash irregular signaling was sent into the Telenor network. This irregular signaling was sent by another international operator and contained types of messages that appear very rarely, the company said in a statement.
– This signaling was misinterpreted in the software that Ericsson has delivered to Telenor’s mobile network and lead to part of the mobile traffic stopping, according to the company, which states that the error is corrected.
I suggest you check out P1 Security's presentations about SS7. Make sure to also check out the related/suggested ones as they are interesting and outline some of the attacks I described above.
