eSIM Swap Fraud

An eSIM (embedded SIM) is a digital SIM profile stored on a chip inside your device rather than a removable physical card. eSIMs allow carriers to activate and transfer phone number profiles remotely, without requiring an in-store visit or a physical card to be swapped. This remote provisioning capability is convenient for consumers but creates a new attack surface that mirrors traditional SIM swap fraud.

In an eSIM swap attack, a fraudster uses the same social engineering techniques as a physical SIM swap — impersonating you to your carrier using stolen personal details — but targets the eSIM provisioning process specifically. The goal is to have your number transferred to an eSIM profile on a device they control. Once accomplished, the attacker receives all your calls and SMS messages, including one-time authentication codes, and the attack proceeds identically to a conventional SIM swap.

eSIM swap fraud is in some respects harder to detect than a physical SIM swap because your physical SIM card does not go dead — in a physical swap, the loss of signal is a clear early warning. In an eSIM swap, the transfer may occur silently or you may receive a carrier notification that is easy to dismiss as routine. The attack is growing in prevalence as eSIM adoption increases and as fraudsters adapt the SIM swap playbook to new provisioning systems.

The attacker first collects personal details about the target: name, address, date of birth, account number, and carrier account PIN if possible. These are gathered from data breaches, social media research, or phishing.

The attacker contacts the carrier — by phone, online portal, or live chat — and impersonates the account holder. They claim to want to set up eSIM on a new device or add an eSIM profile to an existing account. They use the harvested personal details to pass identity verification.

If the carrier's verification is bypassed, they provision an eSIM profile containing the target's phone number to a device the attacker controls. The attacker now receives calls and SMS messages directed to that number, including banking one-time codes and authentication messages for any service linked to the number.

In some variants, the attacker simultaneously initiates password resets on high-value accounts, intercepting the authentication codes as they arrive on the attacker's device. The window of opportunity may be slightly longer than in a physical SIM swap if the victim does not notice the attack quickly — since their physical phone may continue to function normally for some time.

eSIM provisioning is designed to be convenient and largely remote, which reduces friction for legitimate users but also reduces the physical barriers that made some SIM swap attempts harder. There is no in-store visit required, no physical card to produce, and the process can be completed entirely online or by phone.

As with physical SIM swaps, the attack exploits the gap between the data carriers use for identity verification and the ease with which that data can be obtained from breaches and social media. Carriers that do not require a dedicated secure PIN for eSIM provisioning requests are particularly vulnerable.

Growing consumer awareness of physical SIM swaps has not fully translated to awareness of the eSIM variant, meaning the attack benefits from a lag between the technique's prevalence and public knowledge of it.

A person receives an email from their carrier confirming an eSIM profile has been added to their account. They do not remember requesting this. By the time they call their carrier to query it, an attacker has already used the provisioned eSIM to intercept SMS codes and access their primary email and one financial account. The carrier reverses the eSIM provisioning within hours, but account recovery for the affected services takes longer.

Your [carrier] eSIM has been successfully activated on a new device. If this wasn't you, contact us at [official number].

An eSIM profile change has been made to your account. Visit [link] to review this change.

[Carrier] account update: a new device has been added using your phone number. Confirm this was you.

Your number has been provisioned to a new device. If you did not request this, call [official number] immediately.

Contact your carrier to ask whether your account can have eSIM provisioning locked behind an additional security step — a separate PIN or in-person verification. Not all carriers offer this, but it is worth requesting.

Enable any available carrier account alerts for SIM changes, eSIM provisioning, or account configuration changes. If your carrier offers SMS or email notifications for account modifications, enable them — an alert sent to your email may be the fastest warning you receive.

If you notice that your phone is suddenly not receiving calls or texts despite appearing to have signal, or if you receive a carrier notification about an eSIM change you did not initiate, contact your carrier immediately from a different device.