Is eSIM Safe? Security Risks and How to Protect Yourself

TL;DR

• An eSIM cannot be stolen without stealing the phone, which removes one route used in port-out scams. The FCC says so directly.
• ENISA and the GSMA describe eSIM security as equivalent to a removable SIM's. The difference: devices with an eSIM are open only to software attacks, because the chip cannot be removed.
• The practical danger to plan for is SIM swapping, which targets your carrier account and personal details. Port protection or a SIM lock helps.
• Keep your eSIM QR code private. It is usually single-use, so it is not a backup.
• Buy from a seller that shows plan terms before payment and does not ask for more personal data than it needs.
• Wipe your eSIM data before you sell, trade in or recycle a phone.

What makes an eSIM different from a SIM card

An eSIM is a chip built into your phone. Instead of swapping a plastic card, you download a carrier profile, usually by scanning a QR code. That profile holds the same kind of credentials a physical SIM holds: the identifiers and keys your phone uses to prove to a mobile network that it is allowed on.

The Trusted Connectivity Alliance, an industry association for SIM and eSIM technology, explains that an eSIM shares the cryptographic features of the SIM, including a securely designed processor and dedicated secure memory for keys and certificates. These protect devices against cloning, physical attacks and remote attacks. Downloading a profile is not a casual file transfer either. It follows a standard protocol, Remote SIM Provisioning. The GSMA, the mobile industry body that writes the eSIM specifications, says the use of TLS encryption is mandated in that protocol and that the specifications were designed with security in mind.

That is the technical foundation. The rest of this article is about what can still go wrong around it.

Is an eSIM safer than a physical SIM?

On theft and loss, yes. A removable SIM can be taken out of a lost or stolen phone. An eSIM stays with the device. The FCC's eSIM FAQ, last reviewed in August 2025, says an eSIM card cannot be stolen without stealing the phone, whereas removable SIM cards are sometimes stolen and used in port-out scams. In those scams, identity thieves put the stolen card into another phone to get the victim's calls and text messages.

The wider security picture is more balanced than "eSIM wins." The European Union Agency for Cybersecurity (ENISA), in its 2023 report on the embedded SIM ecosystem, says eSIM gives end users an equivalent level of security to that of the removable SIM card. It also draws one key distinction: devices with physical SIMs are susceptible to both hardware and software attacks, while devices with eSIMs are only susceptible to software attacks. The GSMA's eSIM whitepaper makes the same equivalence point.

Here is how the two compare on the points travelers care about:

If you want the practical side of this choice, such as device support and what to check before you fly, our guide to eSIM vs physical SIM for travel covers it.

The real risks, explained plainly

SIM swapping

SIM swapping is when a criminal convinces your carrier to move your phone number to a SIM or eSIM they control. Then they receive your texts and calls, including login codes. ENISA's 2021 report on SIM swapping describes how attackers abuse the provider's ability to port a phone number to a device with a different SIM. The attacker then receives the SMS and voice calls meant for the victim and can commit fraud, such as online banking fraud.

This happens with physical SIMs too. What changes with an eSIM is the method. ENISA's 2023 eSIM report explains that an attacker who has obtained the necessary personal data can claim the device is damaged, get into the subscriber's account on the carrier's portal, start an eSIM swap and then scan the QR code shown there to activate the profile. The weak point is the human and account layer: what the attacker knows about you, and how well the carrier checks identity.

In the United States, the FCC adopted rules on this problem in November 2023. According to the Federal Register notice, published in December 2023, wireless providers must use secure methods to authenticate a customer before a SIM change or a port-out, and notify customers immediately of SIM change and port-out requests. They must also offer all customers, at no cost, the option to lock their account against SIM changes and port-outs, and give clear notice of the account protections they offer. The notice made compliance wait for a later federal review, so ask your carrier which of these protections it offers today, and switch the lock on if it has one.

Phishing and social engineering

ENISA says SIM-swapping fraud usually begins with phishing or social engineering against subscribers. A fake text says your eSIM "needs reactivation," or a fake support caller asks for your date of birth and account PIN. Those details are exactly what an attacker needs for a SIM swap. ENISA's advice: do not give personal information by email or phone to someone who says they are from your mobile operator, and never share a one-time code sent to finish a SIM swap.

The Canadian Centre for Cyber Security advises keeping the answers to account security questions private, such as your date of birth, home address and mother's maiden name. It sounds basic, but those are the details a swap depends on.

Remote attacks and malicious software

Because eSIM profiles can be generated and transferred digitally, the Canadian Centre for Cyber Security warns that eSIMs can make it easier for threat actors to conduct social engineering and remote attacks, compromise multiple profiles at a time and use malicious software through arbitrary code execution. Those are risks at the level of the whole system, and they depend on how well manufacturers, carriers and provisioning servers are run. For an individual traveler, the practical defenses are updating your phone's software, using a screen lock and installing profiles only from the seller you bought from.

The GSMA adds useful context. Responding to a 2024 security analysis of the provisioning protocol by researchers at Aalto University, it noted their finding that the protocol is adequately secured against network attackers when both ends are honest. The attacks the paper describes assume that one end, the provisioning server or the eSIM chip, is already compromised. The GSMA says the use of TLS is mandated, that keeping its implementation intact minimizes exposure to those attacks, and that a certification process exists to reduce the risk of compromised servers and chips. In other words, the standard is sound, and implementation quality is what you are really trusting.

Can an eSIM track you?

An eSIM does not add a tracker to your phone, but any mobile connection reveals some information. Your phone connects to towers, and the network knows roughly where you are. That is true with a physical SIM as well.

The Trusted Connectivity Alliance notes that the IMSI, the subscriber identifier tied to the operator that issued the SIM, can be used to confirm a subscriber's identity and monitor their location, calls and SMS messages. It also explains that 2G, 3G and 4G networks send the IMSI unencrypted, which IMSI-catching attacks exploit, and that 5G uses an encrypted identifier, called SUCI, designed to address this. That applies to SIMs and eSIMs alike. ENISA lists device tracking, through the constant connection to a cellular network, among the potential drawbacks of eSIM for end users. It also notes that biometric authentication on modern phones makes malicious access to an eSIM more difficult.

What a 2025 study found about travel eSIMs

One piece of research deserves a plain mention. At the 2025 USENIX Security Symposium, researchers from Northeastern University presented a study of privacy and security risks in the eSIM ecosystem. They found that travel eSIMs often route user data through third-party networks, including Chinese infrastructure, regardless of where the user is. In lab tests of several travel eSIM profiles, two communicated without any action from the user: one opened a data connection to a server in Singapore, and another retrieved an SMS from a Hong Kong number. Because provisioning often runs through resellers, the researchers note, users have limited visibility into what a profile does.

They also showed that a profile deleted while the phone is offline may not be registered as deleted by the provisioning server. The same QR code then cannot reinstall it until the provider steps in. The researchers say this is not necessarily a security flaw, but it can leave a user without service.

What should you take from that? Not that travel eSIMs are dangerous, but that who provisions your profile matters, and that transparency is a reasonable thing to ask for. Do not delete a travel eSIM to fix a problem. Contact the seller first, and if a profile has to be removed, do it while the phone is online.

Why some people are wary of eSIMs

The skeptics have a few fair points, and they are more about control and convenience than outright security:

1. Less visible control. With a physical SIM you can see and hold what you have. With an eSIM, profile management happens in software, which the USENIX researchers say leaves users with limited visibility or control. Resellers add another layer between you and the network.
2. Deletion and reinstall problems. As the same study showed, a deletion made offline can leave you unable to reinstall a profile until the provider fixes it. Many profiles can only be installed once anyway.
3. Moving phones takes planning. A SIM card moves by hand. An eSIM needs a transfer or a new profile. Our walkthrough on how to transfer an eSIM to a new phone shows the steps.
4. Carrier-locked phones. A locked phone may not accept a profile from another provider. See our guide to using an eSIM on a locked phone before you buy.

None of these is a reason to avoid eSIM. They are reasons to prepare.

Are travel eSIMs safe abroad?

A travel eSIM is a reasonable way to get data abroad, with the same precautions as any eSIM. The FCC points out that when you travel internationally you can select from available options for the countries you plan to visit, instead of replacing your SIM card with one from a local provider. Your home SIM, or your home eSIM line, stays in place, so your number and your carrier account are not handed over at an airport counter.

Two benefits stand out for security:

• No kiosk or counter. You do not hand your phone or documents to a stranger in an arrivals hall.
• Your own cellular connection. Using mobile data instead of open public Wi-Fi means you are not joining a network you know nothing about. Still use common sense with sensitive logins, and keep your phone updated.

A reminder about a data-only travel eSIM: it usually does not replace your phone number for calls and texts, so your bank's SMS codes still go to your home number. Make sure you can receive those codes another way, or that your home line stays active. If you keep the home line on, turning off Data Roaming on it stops roaming data, but calls and texts on that line can still be billed at roaming rates. Our guide to receiving SMS abroad covers the checks.

How to protect your eSIM: a checklist

Do these in order. The first three protect your home number.

1. Ask your home carrier for port protection or a SIM lock. The Canadian Centre for Cyber Security recommends asking your mobile provider to enable port protection or a SIM lock on your accounts, if available, and using any extra verification your provider offers.
2. Move your important accounts off SMS codes. The same agency advises multi-factor authentication that includes methods other than those that rely on your phone number, such as an authenticator app. Use it for email, banking and cloud storage.
3. Treat your personal details as secrets. Do not share your date of birth, address, account PIN or any one-time code with someone who contacts you first, even if they say they are from your carrier.
4. Lock your phone. Use a strong passcode and biometrics. ENISA notes that biometric authentication on modern devices makes malicious access to an eSIM more difficult.
5. Install profiles only from the seller you bought from. Scan a QR code only if it came with your purchase. Our checklist of places to check your eSIM QR code before takeoff shows where to look.
6. Keep your QR code and activation details private. A QR code is usually single-use. Do not share or post it, and do not count on it to reinstall the eSIM later. If something goes wrong, contact the seller.
7. Set up at home, on trusted Wi-Fi. First check what starts the plan's validity: installation or first connection. If installing starts the plan's validity, install on the day you fly. Our guide on when to install your travel eSIM explains the timing.
8. Update your phone's software. Updates include security fixes.
9. Wipe eSIM data before you part with a phone. The FCC says to wipe all data from the eSIM before you dispose of or recycle the device, and to check with the manufacturer and your service provider for how to do it properly.
10. Watch for unexplained loss of service. ENISA says the first sign of a fraudulent SIM swap is an unexplained, more than momentary loss of mobile network access. If that happens on your home line, contact your carrier right away.

How to judge an eSIM provider

The chip may be standard, but the seller is not. Before you pay, check these things:

• Are plan terms visible before payment? Data amount, validity, what starts the validity, country coverage and top-up rules should all be readable before you check out.
• Can you see the per-gigabyte cost? Clear pricing is a sign of a seller that expects to be checked.
• How much personal data does it ask for? Less data collected means less data that can leak.
• Does it help you check your device? A good seller helps you confirm your phone supports eSIM and is unlocked.
• Is delivery clear? You should know how the install code reaches you and what to do if an install fails.
• Is there a support route if setup fails? Look for clear contact options and written refund terms.

If you are not sure your phone is ready, use our page to check whether your phone supports a travel eSIM.

Our take on eSIM safety

We sell travel eSIMs, so we have an interest here, and we would rather say plainly what we believe. The sources above point the same way: the chip is well protected, and the weak points sit around it. Rushed setup at an airport, plans with unclear terms and carrier accounts protected by little more than a birth date are all risks you can reduce before you leave.

That is why we built WayfarerSIM around transparency. Each plan card shows the data, days, coverage and hotspot terms with the full price before you pay, plus the per-GB rate for fixed-data plans. You can check your phone first and pick your plan at home on Wi-Fi. After purchase, we send a QR code and a private trip page. On plans that support top-ups, a top-up goes onto the same eSIM without a new QR code.

We also think the research is worth taking seriously. The 2025 findings on opaque third-party provisioning are a fair reason to ask any seller what its profile does and what terms apply. Ask us the same. Our advice is the one in the checklist above: lock your carrier account first.

Get a travel eSIM you can check before you pay

If you are planning a trip, you can look through plans by region and see the terms before you buy. Start with the Global plans if you are visiting several continents, or browse Europe, Asia, Latin America and Africa.

If you are new to the process, our guide to three fast ways to activate an eSIM before you fly walks through setup.

FAQ

Is an eSIM trustworthy?

Yes. An eSIM shares the cryptographic features of a physical SIM, and profiles are downloaded over a standard protocol that mandates TLS. ENISA and the GSMA describe its security level as equivalent to a removable SIM's. How much you can trust your own setup depends on your carrier account protection and the seller you choose.

Can an eSIM be SIM swapped?

Yes. SIM swapping targets your carrier account, not the chip, so it can happen with eSIMs and physical SIMs alike. An attacker with enough of your personal data may persuade a carrier to move your number. Ask your carrier for port protection or a SIM lock, and use authentication that does not depend on text messages.

Can an eSIM track you?

An eSIM does not add a tracking device, but any mobile connection lets a network know roughly where your phone is. Subscriber identifiers can be used to monitor location, which is why 5G adds an encrypted identifier. If you want fewer traces, choose sellers that collect little personal data and keep your phone updated.

Why are some people against eSIMs?

The main objections are about control and convenience. Profiles are managed in software, so you see less of what is happening, and resellers add layers. A profile deleted while the phone is offline can also block reinstallation until the provider fixes it, and moving to a new phone takes more steps than moving a card.

What should I do with an eSIM before selling my phone?

Wipe all eSIM data first. The FCC says to wipe the eSIM before you dispose of or recycle a device, and to ask the manufacturer and your service provider how to do it properly. Remove the profile while the phone is online, then factory reset.

Sources

• eSIM Cards FAQ, Federal Communications Commission
• Protecting Consumers from SIM-Swap and Port-Out Fraud (FCC final rule, December 2023), Federal Register
• Countering SIM-Swapping (December 2021), ENISA
• Embedded SIM Ecosystem, Security Risks and Measures (March 2023), ENISA
• Security Analysis of the Consumer Remote SIM Provisioning Protocol, GSMA
• eSIM Whitepaper: The what and how of Remote SIM Provisioning (March 2018), GSMA
• eSIM, Trusted Connectivity Alliance
• Protecting Subscriber Privacy in 5G (March 2021), Trusted Connectivity Alliance
• Security considerations for SIMs (ITSAP.10.021), Canadian Centre for Cyber Security
• eSIMplicity or eSIMplification? Privacy and Security Risks in the eSIM Ecosystem, USENIX Security 2025

Recommended

• eSIM vs Physical SIM for Travel: Check Compatibility Before You Fly
• eSIM QR Codes: The 4 Places to Check Before Takeoff
• Travelers: 3 Checks Before You Rely on a Multi Country eSIM
• Use an eSIM Abroad: 4 Checks Before You Buy