Fake Vodafone eSIM Roaming Upgrade Scam
Criminals impersonate Vodafone to send urgent eSIM activation or roaming-upgrade requests, tricking customers into scanning malicious QR codes that transfer their phone number to the scammer's device.
Part of: Fake eSIM & Roaming Scams
Last reviewed: 8 June 2026
Vodafone has rolled out eSIM support across its consumer and business plans in multiple markets. Unlike a physical SIM, an eSIM is activated by scanning a QR code provided by the carrier, making it an appealing vector for SIM-swap-adjacent fraud. Scammers impersonate Vodafone to send fake eSIM migration or roaming upgrade notifications that include a fraudulent QR code.
When a victim scans the attacker's QR code and installs it on their device, the fraudulent eSIM profile redirects calls and SMS messages — including one-time passcodes — to a device the scammer controls. This enables account takeovers at banks, email providers, and any service that uses SMS-based two-factor authentication.
Real Vodafone eSIM QR codes are generated exclusively within the My Vodafone app or in-store, never sent unsolicited via email or text. Any message arriving out of the blue with an eSIM QR code should be treated as a serious threat.
How this scam works on the Vodafone brand
The phishing email arrives from a domain like 'vodafone-esim-upgrade.com' and states: 'Your Vodafone account has been selected for a free eSIM upgrade. Scan the QR code below to activate enhanced roaming coverage on your trip.' The email includes a high-quality Vodafone logo and a plausible-looking QR code.
Alternatively, a text arrives claiming: 'Vodafone: Your plan includes a new international roaming eSIM. Scan the QR code in the link to activate before your next trip.' Both variants time delivery to coincide with typical travel seasons.
Once the malicious eSIM is installed, the victim's device registers the new profile. Depending on the device, calls and SMS may continue on the original SIM while the scammer receives a mirror of incoming one-time codes on their device, enabling silent account takeovers without the victim being immediately aware.
Common red flags
- An email or text arrives unsolicited with a QR code to activate an eSIM you never requested
- The sender domain is not '@vodafone.com' or one of Vodafone's verified regional domains
- The message claims a 'free upgrade' or 'enhanced roaming' is available — Vodafone does not typically push eSIM migrations via unsolicited emails with QR codes
- The QR code is embedded in the email body rather than generated within the My Vodafone app
- You begin missing expected SMS messages or calls shortly after scanning a code
- Unknown eSIM profiles appear in your device's Settings > Mobile / Cellular > eSIM or SIM Management section
How to protect yourself
- Never scan an eSIM QR code you received unsolicited — visit a Vodafone store or log in to My Vodafone at vodafone.com to request a genuine eSIM
- Check your device's SIM management settings regularly for any unrecognised eSIM profiles and delete them immediately
- Enable a SIM lock or account PIN through your Vodafone account to prevent unauthorised eSIM transfers
- If you scanned a suspicious QR code, contact Vodafone immediately at the number on vodafone.com to have your number protected
- Change passwords for any accounts that use SMS-based two-factor authentication if you suspect SIM swap activity
- Enable app-based authenticators (such as an authenticator app) rather than SMS-only 2FA wherever possible
How to report it
- Report suspicious eSIM messages to Vodafone at [email protected] (UK) or your regional Vodafone fraud line
- Forward suspicious texts to 7726
- Report the incident to your national cyber security authority (NCSC in the UK at report.ncsc.gov.uk; CISA in the US at cisa.gov/report)
- File a complaint with the FTC at reportfraud.ftc.gov if you are in the US
Frequently asked questions
How does a fraudulent eSIM let scammers intercept my SMS messages?
When an eSIM profile is installed, the device registers that number with the carrier's network. If a scammer's device registers your number via a stolen eSIM QR code, incoming SMS (including one-time codes) can be routed to their device.
How do I check for rogue eSIM profiles on my phone?
On iPhone: Settings > Cellular > scroll to see all plans. On Android: Settings > Connections > SIM Manager. Delete any profile you do not recognise and contact Vodafone.
Is Vodafone responsible for compensating me if my account is taken over via eSIM fraud?
This depends on jurisdiction and circumstances. File a formal complaint with Vodafone and, if unresolved, escalate to your country's telecoms regulator (Ofcom in the UK, FCC in the US).