How it works
Is an eSIM secure? What it protects, what it doesn't, and what's on you
It can't be taken out of the phone, and that changes things for better and for worse. Which risks are real, which are myths, and what's worth having switched on.
Dani Requena 6 min Photo by Kévin Pesqué on Unsplash The question nearly always arrives with the same suspicion behind it: if you never touch the card any more, who's in control of it? The short answer is that an eSIM is at least as secure as a physical card, and on a couple of specific points it's better. And there's one real risk that doesn't change with the format.
What improves on a physical card
- It can't be removed. Nobody takes the card out of a stolen phone to use your line in another handset, or to leave yours unreachable.
- The profile travels encrypted and signed from the operator to the chip, under a standard designed for exactly that.
- It can be deactivated remotely by your operator, just like a card, without anyone having to eject anything.
What doesn't change
The real risk to a phone line isn't in the plastic: it's SIM swap fraud, where somebody convinces your operator to issue them a duplicate of your line so they receive your verification messages.
That happens with cards and eSIMs alike, because the weak point isn't the technology, it's the operator's identity checks. What does protect you is not relying on text messages as your only verification method for anything that matters.
- Use an authenticator app instead of text messages wherever you can, especially for banking and email.
- Put a PIN on your SIM and a strong lock on your phone.
- Switch on your operator's alerts for changes to your line.
- If your phone loses signal suddenly and oddly, check with your operator that nobody has requested a duplicate.
The myths
| What people say | What's actually true |
|---|---|
| An eSIM can be cloned over the internet | The profile is encrypted and tied to one specific chip |
| Someone can install an eSIM on your phone without you knowing | Installing a profile needs physical access to your unlocked phone or to your operator account |
| eSIMs track you more | Network location works the same with any line |
| Your operator sees more of what you do | It sees exactly what it sees with a card |
And a travel eSIM specifically
A travel data plan is a data line from a local operator: it sees your traffic the same way the network of any country you connect from would, no more and no less. If you want to encrypt your traffic on networks you don't control, that's what a VPN is for, and it applies to hotel wifi just as much as to mobile data.
Frequently asked questions
Is an eSIM secure?
At least as secure as a physical card, and better on one point: it can't be pulled out of a stolen phone. The profile travels encrypted and tied to one specific chip.
Can an eSIM be cloned?
Not over the internet. The profile is encrypted and assigned to one phone's chip, and installing one needs physical access to your unlocked phone or to your operator account.
Does it protect me from SIM swap fraud?
No, because that fraud attacks the operator's identity checks, not the card. What helps is not relying on text messages as your only verification method.
Does my operator see more with an eSIM?
No, it sees the same as with a physical card. If you want to encrypt your traffic on networks you don't control, that's what a VPN is for.
What should I do when I sell my phone?
Delete its eSIM profiles explicitly, because resetting the handset doesn't always remove them.
