Is an eSIM Safe? Theft, SIM-Swap and Privacy
Yes. An eSIM is at least as safe as a physical SIM, and in one way safer: there is nothing a thief can pull out of your phone. It doesn't make you immune to every phone scam, though. Here is what an eSIM changes, what it doesn't, what we store about you, and how mobile data compares with public Wi-Fi.
If your phone is stolen
With a physical SIM
A thief can take the card out and put it in another phone. If the SIM has no PIN, that phone now receives calls and SMS for your number, including one-time sign-in codes, until you call your carrier to block it.
With an eSIM
There is no card to remove. The plan lives on a chip inside your phone, so whoever has the phone has to get past its lock screen to do anything with it. That closes one easy route. It doesn't replace the basics:
- Use a strong screen lock and biometrics.
- Set a SIM PIN on your home line, whether it is a physical SIM or an eSIM. On iPhone it is under Settings → Cellular → [line] → SIM PIN; on Android, look in the security settings for a SIM lock. Names vary by phone. Have your carrier's PUK code to hand before you try, because a wrong PIN too many times locks the SIM.
- Turn on your phone's find-my-device feature before you travel, so you can locate, lock or erase it remotely.
- Know how to reach your carrier from abroad to block your home number if the phone goes missing.
SIM-swap fraud: what it really targets
In a SIM-swap, someone convinces your carrier to move your phone number to a SIM or eSIM they control. Your phone loses service, theirs starts receiving your calls and SMS codes, and they use those to get into your accounts. The attack happens at the carrier, so it works against a physical SIM and an eSIM alike. An eSIM is no weaker and no stronger here.
A travel eSIM doesn't add to this risk. Most of our plans are data only and have no phone number, so there is nothing to swap. Your exposure stays with your home number, and the defences are the same as at home:
- Ask your carrier about an account PIN or password and any protection against number transfers they offer.
- Prefer an authenticator app or passkeys over SMS codes for important accounts, where the service allows it.
- Turn on WhatsApp two-step verification, so a stolen number alone isn't enough to take over your chats. More in keep your WhatsApp number abroad.
- Treat sudden "No Service" at home as a warning sign and call your carrier from another phone.
Your install code is a key
The QR code and install link are what put the plan on a phone. Until you have installed it, treat it like a key: don't post a screenshot of it or forward it to anyone you wouldn't hand the plan to. Once it is installed on your phone, an install code usually can't be used again. Only install eSIMs from a source you bought from yourself.
What we can see, and what we can't
Our privacy page is short, and so is the list:
- What we keep: an anonymous device id, your email if you give one for the receipt, and the order. No contacts, no location.
- What we share: the order with our connectivity supplier, so it can issue the eSIM, and the payment with Stripe. Nothing else.
- Delete: email hello@e-sim.net from the receipt address and we delete the account and its eSIM records.
Payment goes through Apple Pay, Google Pay or card via Stripe. Your account is created from the payment, so there is no extra form with personal details.
Your data traffic itself is carried by the mobile networks, as it is with any SIM. That is why what you send matters more than which SIM sends it, which brings us to Wi-Fi.
Public Wi-Fi vs mobile data
Airport, café and hotel Wi-Fi is convenient but shared. Many networks are open or use one password for everyone, and it is easy to set up a fake hotspot with a convincing name. On such a network, others may be able to see which sites you visit, and anything not encrypted.
Mobile data works differently: it is encrypted over the air, between your phone and the mobile network, and you are not sharing a local network with strangers. That protection covers the radio link, not your traffic once it is inside the network or on the internet, so it doesn't replace HTTPS or encrypted apps. With a travel eSIM you can skip the airport Wi-Fi login and the hotel network entirely.
Either way, the best protection is in the apps you use:
- Use sites with HTTPS (the padlock) and official apps for banking.
- Messaging apps with end-to-end encryption, such as WhatsApp, iMessage and Signal, protect message content on any connection.
- Don't sign in to important accounts from a captive portal page or a shared computer.
- Turn off auto-join for networks you used once.
The short checklist
- Screen lock on, find-my-device on, SIM PIN on the home line.
- Carrier account PIN set; authenticator app for important accounts.
- Install the travel eSIM at home, from your own receipt, and keep the code private.
- Use the travel eSIM's data instead of open Wi-Fi for anything sensitive.
New to eSIM? Start with what an eSIM is or compare it with a card in eSIM vs physical SIM. When you are ready, pick a destination on the eSIM page.
Questions
Can someone steal my eSIM?
Not by taking it out of the phone, because there is nothing to remove. Protect the phone itself with a screen lock, and treat your install QR code like a key until you have installed it.
Does an eSIM protect me from SIM-swap fraud?
Not on its own. SIM-swap happens at your carrier, which can be tricked into moving your number to another SIM or eSIM. Ask your carrier about an account PIN and use app-based sign-in codes where you can.
Is mobile data safer than hotel Wi-Fi?
Usually. Mobile data is encrypted over the air between your phone and the network, while public Wi-Fi is often shared or open. That doesn't cover your traffic beyond the network, so HTTPS sites and encrypted apps still matter on either.