TL;DR
An eSIM is a chip built into your phone, so a thief can't take it out, which means a stolen phone usually stays connected and can be located, locked, or wiped remotely. Scammers can still try to take over your number, most often by persuading your carrier to move it to a SIM they control (a SIM swap) or by sending you a fake eSIM activation link that moves it to their phone. Set a PIN with your carrier, use an authenticator app instead of text-message codes, and only install an eSIM from your provider's own app or website to stay protected.
What an eSIM is and how it is protected
The technical name for an eSIM is an eUICC, an embedded universal integrated circuit card. It is a small tamper-resistant chip already soldered into your phone, and unlike the plastic SIM it is not tied to one operator (your network provider or an eSIM provider) for life. It can hold several operator profiles and download new ones in seconds.
That download is remote SIM provisioning, the process defined in the GSMA's eSIM specifications. Before anything is on your phone, the device and the operator's provisioning server exchange certificates and verify each other, and the profile is then encrypted for that one specific chip. It lands inside the secure element, a protected area of the chip that the rest of the phone's software cannot read.
Researchers at Aalto University modeled the eSIM download protocol and searched it for ways an attacker could break in. The results published by the GSMA found it adequately secured against hackers. The weaknesses the analysis did surface all assume the provisioning server or the chip is already compromised before you download.
eSIM and physical SIM: what changes and what doesn't
What happens | Physical SIM | eSIM |
|---|---|---|
Someone steals the phone and moves the SIM to their own device | Possible, the card pops out | Not possible, the chip is soldered in |
Cloning the card with physical access | A known attack on older cards | No card to remove or copy |
Protected by a SIM PIN | Yes | Yes, where the phone supports it |
Erased when you wipe the phone | Only if you take the card out | Erased in settings, or kept on purpose |
Moving to a new handset | Move the card | Transfer the profile |
Your phone number and carrier account | Unchanged | Unchanged |
The network your phone connects to | Unchanged | Unchanged |
Encryption of your traffic | Unchanged | Unchanged |
The FCC puts the practical difference plainly in its eSIM guide: an eSIM cannot be stolen without stealing the phone. Physical SIMs do get lifted out of lost handsets and used to steal personal data and your number.
Are eSIMs safe from SIM swapping, phishing and other scams?
An eSIM can't stop these scams, and neither can a physical SIM, because they target your accounts rather than your phone.
SIM Swaps
In a SIM swap, a scammer pretends to be you and persuades your carrier, usually through customer support, to move your number to a SIM they control. From then on, your calls and texts go to them, including the one-time codes for your bank and email.
“A thief who takes your phone can pop out a physical SIM, put it in another phone, and start receiving your calls and SMS codes for bank logins, 2FA and password resets. With an eSIM, the profile is locked to the phone’s secure hardware. Since a thief can’t remove the eSIM, the phone usually stays connected to the network, so Find My iPhone or Find My Device can still locate, lock, or wipe it. Removing a physical SIM is often the first thing a thief does to take a phone offline."
Asım Alp, Co-founder and CTO, Roamless (15+ years in Telecommunications)
There’s also a version that targets eSIM users directly. Scammers posing as your carrier call or text with a link to “activate” an eSIM, and clicking it moves your number to their phone.
How much your carrier has to check before moving your number depends on where you live:
Where | What the rules say |
|---|---|
United States | The FCC adopted rules in 2023 that require carriers to verify your identity securely before moving your number, and to tell you when someone tries. Carriers were given more time to comply in July 2024. |
Australia | Since June 30, 2022, telcos have had to use multi-factor checks, such as your personal details plus a one-time code, before a SIM swap. They also have to keep records of those checks for at least a year. |
Canada | The CRTC has asked carriers for data on unauthorized SIM swaps and number transfers, in 2020 and again in 2023. In July 2026 it changed the transfer process so a new carrier can’t activate your number until your old carrier confirms the move. |
United Kingdom | No regulator rule targets SIM swaps. Instead, mobile networks signed a fraud charter with the government in November 2025, committing to shared practices against account takeover, such as two-factor authentication before account transfers. |
European Union | There’s no EU-wide rule, though some countries, such as Italy, have their own. |
Wherever you are, ask your carrier what it checks before it moves your number to a new device.
Phishing
Phishing is how many scams start. Scammers send emails and texts that look like they come from a company you trust, such as your bank or carrier, to get your passwords or account details. SIM swappers also use phishing on carrier staff to get access to your account (FBI).
AI Scams
AI makes impersonation easier still. There have been cases of criminals using cloned voices to get into people's bank accounts, and AI-generated fake IDs to pass identity checks (FBI).
To protect yourself from all of these scams:
Set an account PIN or passcode with your carrier, and never give it to anyone who calls asking for it.
Ask whether your carrier offers a number lock or port freeze, and turn it on.
Use an authenticator app instead of text-message codes wherever you can, and keep the backup codes somewhere you can reach without your phone.
Don't use links in messages you weren't expecting. Go to the company's app or website yourself instead.
If a call asks for money or a code, hang up and call back on a number you look up yourself.
Agree a secret word or question with your family, so you can check it's really them on the phone.
Can an eSIM be hacked?
In theory, an eSIM can be hacked, but the one published attack on a consumer eSIM chip needed the chip in the attackers' hands.
In 2025, the research lab Security Explorations broke into a Kigen eSIM chip through a test profile and pulled out the key that identifies the chip, which let them download eSIM profiles from mobile operators.
But repeating an attack like this would require both the chip and the test profile's access codes, and steps have since been taken to make it harder still. Kigen has patched the flaw, and the GSMA has changed its rules to block the same route.
What your eSIM provider can see
A travel eSIM is a roaming product. Your data rides a local host network under a roaming agreement and your provider routes it, which gives them the visibility any mobile operator has over any customer:
Which towers you used
Roughly when and where
How much data you moved
Which servers you connected to
What it does not give them is the contents, which are encrypted between your phone and the app or site you are using. Your home carrier has precisely the same view if you roam on its international travel plans.
Using an eSIM for banking and 2FA
Travel eSIMs are data only, so they come without a phone number and cannot receive regular calls or SMS codes.
If you want to keep banking and OTPs (one-time passwords) working abroad,
Keep your home SIM active with data roaming switched off, so texts and one-time codes still land on your usual number without a roaming bill.
Set the travel eSIM as the cellular data line.
Move critical accounts to an authenticator app before you fly, and save the backup codes.
Tell your bank you are traveling if it offers that, because a login from an unfamiliar country can trigger a block.
If you want to receive calls and SMS codes anywhere, at home or abroad, you can also simply get a phone number that doesn't need a physical SIM or an eSIM.
Use mobile data rather than public wifi for the banking session itself. Airport and hotel wifi is shared, unmanaged and easy to imitate. Cellular traffic is encrypted between your phone and the operator's equipment, and there is no shared network for anyone else to join.
How to choose an eSIM provider you can trust
Just as important as technical security is how much you can trust an eSIM provider. That usually comes down to the provider being transparent and fair about what it’s charging you and what data it collects. Start by checking if the eSIM provider:
Tells you which local networks it uses. Coverage and speed depend on the network, so this is what you’re really paying for.
Is upfront about speed and fair-usage limits, which saves you from slower data mid-trip that you weren’t warned about.
Makes it clear when your data expires. Otherwise, you could lose data you’ve already paid for.
Offers easy-to-reach customer service and a clear refund policy, in case your eSIM won’t install or connect.
Sells directly through its own website or app. That way, your QR code is new and comes with the provider’s support.
Only asks for the app permissions it needs, because anything more means it’s collecting data it doesn’t need.
If an eSIM provider makes this information hard to find, consider looking elsewhere.
One global eSIM for wherever you are
A Roamless global eSIM covers 200+ destinations, so you install it once and it keeps working as you cross borders. With Credits that never expire, the data you buy is ready whenever you need it, at home or on your next trip.
eSIM security FAQs
Can eSIMs be hacked?
Technically, it’s possible to hack an eSIM, but it’s very unlikely to happen to you. The only published hack of a consumer eSIM chip, by the research lab Security Explorations in 2025, needed the chip in the attackers’ hands and a set of access codes. The chip’s maker, Kigen, has since released a patch (Security Explorations, Kigen). The real risks are scams that target your accounts, such as SIM swapping and phishing, which work the same with an eSIM or a physical SIM.
Can an eSIM be cloned?
Not in normal use. When an eSIM downloads, it’s encrypted for the one chip in your phone. In the only published case of researchers copying eSIM profiles, they first had to break into a chip they physically held (Security Explorations).
Can an eSIM be tracked?
No more than a physical SIM. Any phone that’s switched on and connected to a mobile network can be roughly located by the operator from the towers it uses, whatever kind of SIM it has (EFF).
Is an eSIM safe for online banking?
Yes, and the cellular connection is safer than public wifi for it. A data-only travel eSIM cannot receive SMS codes, so keep your home line reachable or move your accounts to an authenticator app before you go.
Is there any reason not to use an eSIM?
Three practical ones. If your phone dies you cannot move a chip into a spare handset the way you can pop out a card. Some profiles cap how many times they can be reinstalled. And a handful of markets are awkward to buy in once you are there.
What countries don't allow eSIMs?
eSIMs work in most countries, but a few limit how you buy or use them. In Turkey, many international eSIM providers’ websites and apps are blocked. Travel eSIMs connect through local networks, though, so one you’ve already installed before arriving in Turkey works as normal. In Russia, mobile data on foreign SIMs, including eSIMs, has been reported to cut off for 24 hours after you arrive. And phones sold in mainland China only got eSIM support in October 2025, so if you bought yours there, check that it supports eSIM.
What happens to my eSIM if my phone is lost or stolen?
The profile cannot be removed from the handset, and a remote erase takes it with everything else, though you can choose to keep the eSIM when you wipe the phone. Call your carrier to suspend the line as well, because the account is what an attacker would go after.
Can my eSIM provider see what I browse?
They see what any mobile operator sees: volumes, timings, approximate location and which servers you contacted. Not the contents, which are encrypted between your phone and the site. Your home carrier sees the same when you roam.
Is an eSIM more secure than a physical SIM?
For physical theft it is more secure, because there is no card to take out. For everything else the two are the same, because the parts that get attacked are your carrier account and your passwords, and those do not change when the card does.
Glossary
eUICC: the embedded chip an eSIM lives on. The hardware.
Secure element: the protected part of that chip where credentials are stored, walled off from the phone's other software.
eSIM profile: the operator credentials downloaded onto the chip. The thing that makes your phone a customer of a particular network.
Remote SIM provisioning: the GSMA-defined process for delivering a profile over the air.
IMSI: the subscriber identity a network uses to route your calls and texts. The thing a SIM swap moves.
SM-DP+: the operator's provisioning server, the address your phone contacts to fetch a profile.
TOTP: the rotating six-digit code from an authenticator app, and the reason it resists SIM swapping better than SMS does.
