Overview
Physical SIM cards have a well-understood security model: steal the card, access the number. eSIMs work differently, and understanding the difference matters — especially for travellers and business users who rely on their mobile number for two-factor authentication.
SIM Swapping: The Real Threat
The most significant security risk associated with eSIM isn't unique to eSIM — it's SIM swapping, which has existed with physical SIMs for years. In a SIM swap attack, an attacker convinces your mobile operator to transfer your number to a new SIM or eSIM under their control. With your number, they can intercept SMS-based two-factor authentication codes and take over accounts. The attack vector is social engineering of your carrier's customer support — not a technical flaw in eSIM itself. Carriers have improved their verification processes, but the risk remains.
eSIM-Specific Considerations
Unlike a physical SIM, an eSIM profile exists as data rather than hardware. This means it can theoretically be cloned if the cryptographic keys were somehow extracted — but in practice, the security standards governing eSIM (the GSMA RSP specification) make this extremely difficult. The QR code used to install a profile is a more immediate concern: it should be treated like a password. Anyone with your QR code can install your eSIM profile on their device. Delete activation emails once the profile is installed, and never screenshot your QR code and store it in an unencrypted location.
How to Protect Your Primary Number
The practical steps here are straightforward. First, contact your UK operator and ask about their SIM lock or port freeze options — most major UK carriers offer some form of account-level protection against unauthorised number transfers. Second, reduce your reliance on SMS for two-factor authentication: switch critical accounts to an authenticator app instead. Third, use a strong, unique PIN for your account with your operator — not your date of birth. These steps apply regardless of whether you use a physical SIM or eSIM.
Security When Using a Travel eSIM
Travel eSIMs — the kind you buy for a trip abroad — carry lower inherent risk because they're typically data-only and not linked to your primary phone number. The main precaution is buying from a reputable provider. Rogue eSIM providers are theoretically capable of routing your traffic through infrastructure they control, though this would be commercially suicidal and technically complex. Stick to established providers with clear privacy policies and known network partnerships. For very sensitive work, consider a dedicated travel device with no personal accounts installed.
The Bottom Line
eSIM is not inherently less secure than a physical SIM — the attack surface is largely the same, and the GSMA standards are robust. The practical risk is concentrated in SIM swapping and the handling of activation QR codes. Address both of those specifically, and eSIM is a safe choice for personal and business use.
