The UE starts T3520 on AUTHENTICATION FAILURE transmission with the specified causes and should consider the network false on first 5G AKA expiry unless emergency registered.
Our summary of the spec text quoted below.
1What the spec says
Timer value
15s NOTE 7 NOTE 8 In WB-N1/CE mode, 33s For access via a satellite NG-RAN cell, 20s NOTE 12
Transmission of AUTHENTICATION FAILURE message with any of the 5GMM cause #20, #21, #26 or #71 Transmission of AUTHENTICATION RESPONSE message with an EAP-response message after detection of an error as described in clause 5.4.1.2.2.4
AUTHENTICATION REQUEST message received or AUTHENTICATION REJECT message received or SECURITY MODE COMMAND message received when entering 5GMM-IDLE mode indication of transmission failure of AUTHENTICATION FAILURE message from lower layers
On first expiry during a 5G AKA based primary authentication and key agreement procedure, the UE should consider the network as false and follow item g of clause 5.4.1.3.7, if the UE is not registered for emergency services. [...]
3GPP Scout built this page from TS 24.501 V20.1.0 as indexed on 2026-10-15. The quotes are copied from the spec, and code checks each one against the stored text and the 3GPP archive file before publishing. The plain-words line was written by an AI model (GPT-6 Sol) and checked against the quotes by a second AI model from another company (Claude Opus 5.5). The official 3GPP text governs.