Are eSIMs Safe in 2026?

eSIM adoption is no longer a “nice-to-have” feature — it’s the default direction.

More devices ship with stronger eSIM support, and more carriers push self-service activation, which improves convenience without compromise for many users.

However, the biggest shift is also the simplest: in the U.S., Apple’s iPhone 14 models removed the physical SIM tray entirely, making eSIM the only connectivity option on those models and newer in that market (including iPhone 14 Pro).

That one hardware decision is a major reason people are re-checking their assumptions about security right now.

The upside is clear: there’s no physical SIM card to steal. The tradeoff is equally clear: your security posture now leans more heavily on account controls and provisioning workflows precisely where real-world fraud typically concentrates.

On the regulatory front, the EU Cyber Resilience Act is raising the compliance floor: security reporting obligations begin September 2026, with full application by December 2027 meaning software and security governance around connected devices, including eSIM-capable hardware running iOS and Android, is likely to tighten further.

Calibrating Fear vs. Reality

ENISA’s analysis of the embedded SIM ecosystem found very few reported cybersecurity breaches involving eSIMs in Europe since 2010. That’s an encouraging baseline.

However, “low reported breach prevalence” is not the same as “risk-free,” especially when attack patterns tend to migrate toward the easiest weak link — which is usually identity verification, account recovery, or device access rather than the eSIM chip itself.

Security Measures and Best Practices

Reported eSIM-specific cybersecurity breaches have been rare in Europe historically—ENISA’s analysis of the embedded SIM ecosystem confirms that exotic protocol-level exploits are not the dominant threat vector.

The practical risk remains account takeover and social engineering, which is exactly why the controls below focus on account and recovery hardening rather than speculative eSIM exploits.

Priority Ladder — Ranked by Impact

• Carrier port locks / number lock — mitigates port-out fraud and SIM swap; highest leverage, single call to your carrier
• Passkeys or authenticator-app 2FA on primary email — mitigates account takeover; email is the root-of-trust for nearly every password reset
• Passkeys or authenticator-app 2FA on carrier account — mitigates unauthorized account changes and line transfers
• Device screen lock + Find My / device locator — mitigates lost-device takeover and unauthorized eSIM transfer
• Unique, unshared carrier account password — mitigates credential-stuffing attacks against your carrier
• Backup codes stored offline — mitigates lockout after SIM swap disrupts SMS-based recovery
• Account-change alerts on carrier, email, and bank — reduces blast radius by enabling immediate response to unauthorized changes

Carrier Account Protections (PINs, Port Locks, Number Lock)

What to request from your carrier

Contact your carrier by phone, chat, or in-app support and ask explicitly for each of the following controls by name:

• Port-out PIN / Transfer PIN — a separate numeric code required before your number can be ported to another carrier
• Number lock / port freeze / port block — a flag on your account that blocks all outbound port requests regardless of PIN
• Account Takeover Protection (ATP) — a carrier-level flag (offered under various names) that adds extra identity verification requirements before account changes are processed

Wording you can use

“I’d like to enable a port-out PIN, number lock, and any account takeover protection flag you offer. Can you confirm each is active on my account before I hang up?”

Ask the representative to read back the controls that are now active. Note the date, representative ID, and confirmation number.

Verification step

After the call, log into your carrier’s app or web portal. Look for a security or account protection section—most major carriers surface number lock and port-freeze status there (for example, Verizon and T-Mobile both expose these controls in their account security settings, though the exact labels can differ).

If you cannot verify it visually, call back and repeat the request; do not assume it was applied.

Operational hygiene

Set a carrier account password that is unique—not your email password, not a recycled password from any other service. Use a password manager to generate and store it.

While you’re in the account, remove any unauthorized lines or devices, and review which users are listed as authorized account managers or line managers. Limiting who can request changes is a meaningful control.

Be aware that customer support social engineering—where an attacker impersonates you to a support agent—is one of the most common failure points in SIM swap attacks.

Strong carrier-side locks (number lock, ATP) compensate for this by requiring in-store ID or additional verification steps that phone agents cannot bypass.

Strong Authentication and Passkeys/2FA

Understanding your two factor authentication options

Not all second factors carry equal protection. Here is a practical breakdown:

• SMS/text-based codes — convenient but fail completely under a SIM swap; an attacker who controls your number receives your codes. Avoid for any high-value account.
• Authenticator-app TOTP (Time-based One-Time Password) — codes generated locally on your device; immune to SIM swap but vulnerable to real-time phishing if an attacker tricks you into entering the code on a fake site.
• Push-based prompts (e.g., Duo, Google Prompt) — convenient but susceptible to push-fatigue attacks where an attacker repeatedly sends approval requests hoping you tap “Allow.” Enable number-matching in supported apps to mitigate this.
• Hardware security keys (FIDO2/WebAuthn) — the strongest option; phishing-resistant by design because the key verifies the site’s origin before signing. Resistant to SIM swap, push fatigue, and real-time phishing simultaneously.
• Passkeys — device-bound cryptographic credentials that offer phishing-resistant authentication without a separate hardware token; an excellent option when supported.

Minimum bar recommendation: Enable passkeys wherever the service supports them. For accounts that don’t yet support passkeys, use an authenticator app for TOTP. Remove SMS as a fallback where the option exists.

High-risk user recommendation: Use a hardware security key (e.g., YubiKey or equivalent) as the primary and backup authenticator for your primary email account and all financial accounts. Keep a second key in a secure location as a backup.

Your email inbox is your root-of-trust

Almost every account recovery flow—carrier, bank, social media—routes through your primary email address.

If an attacker gains access to your inbox after a SIM swap triggers a password reset, every downstream account is at risk. Treat your email security protocol as the foundation:

1. Secure your primary email with the strongest MFA available (passkey or hardware key).
2. Open your email settings and audit forwarding rules; remove any you did not create.
3. Confirm your recovery email address and recovery phone number are accounts and lines you control—and that the recovery phone is not the same number at highest risk of SIM swap.

eSIM Transfer Controls and Device Binding

What device binding means in practice

An eSIM profile is installed to a specific device’s secure element via a remote provisioning flow that involves the carrier, the eSIM Remote SIM Provisioning (RSP) server, and your device’s OS.

Transferring an eSIM profile to a new device generally requires an OS-mediated flow (for example, Apple’s eSIM Quick Transfer or a new QR code scan) and/or carrier authorization.

This means that an attacker with only your phone number cannot silently move your eSIM to their device without either carrier-account access or physical access to your unlocked phone.

However, the edge case is the one worth respecting: if an attacker compromises your carrier account, they may be able to trigger a transfer through official carrier channels regardless of device binding.

That’s why layered controls matter — carrier locks plus strong authentication, not one or the other.

Reducing unauthorized transfers at the OS level

• Enable a device screen lock using a strong PIN or biometric; without it, anyone with brief physical access can initiate an eSIM transfer.
• On iOS, enable Screen Time with a separate passcode to restrict changes to cellular settings and eSIM profiles.
• On Android, ensure that changes to mobile network settings require device authentication where your version supports it.
• Keep your device on your person. Avoid handing an unlocked phone to someone you do not fully trust—eSIM transfer flows on both iOS and Android can be initiated quickly on an unlocked device.

Before you sell or send your phone for repair — micro-checklist

• Remove all eSIM profiles (Settings → Cellular/Mobile Data → manage plans → delete, on both iOS and Android).
• Sign out of Apple ID (iOS) or Google Account (Android) before initiating a factory reset.
• Disable Find My (iOS) / Find My Device (Android) — a reset without doing this can leave the device locked to your account.
• Contact your carrier to confirm the line status and that no pending transfers are queued.

Mobile OS Security Settings (iOS/Android)

iOS checklist

• Full-disk encryption: Enabled automatically when you set a device passcode. Verify by going to Settings → Face ID & Passcode (or Touch ID & Passcode) and confirming a passcode is set.
• Software update / OS updates: Settings → General → Software Update → enable Automatic Updates. Install security patches within 7 days of release.
• Find My + Remote Wipe: Settings → [Your Name] → Find My → enable Find My iPhone and Send Last Location.
• Lock-screen access: Settings → Face ID & Passcode → disable “Today View,” “Notification Center,” and “Control Center” from the lock screen to prevent toggle abuse (e.g., Airplane Mode) while locked.
• Notification previews: Settings → Notifications → Show Previews → set to “When Unlocked” to prevent SMS codes from being visible on lock screen.
• App install hygiene: Only install apps from the App Store; avoid enterprise/MDM profile sideloading unless you manage it yourself.

Android checklist

• Full-disk encryption: Enabled by default on modern Android (verified by going to Settings → Security → Encryption; should show “Encrypted”).
• Software update: Settings → System → System Update; enable automatic security updates. On Samsung Galaxy and Google Pixel devices, security patches are delivered monthly.
• Find My Device + Remote Wipe: Settings → Security → Find My Device; sign in with your Google account and confirm the device appears at myaccount.google.com/find-your-phone.
• Lock-screen notifications: Settings → Notifications → Notifications on lock screen → set to “Hide silent conversations and notifications” or “Don’t show notifications” to limit exposed content.
• Unknown sources off: Settings → Apps → Special App Access → Install Unknown Apps; confirm no app has this permission unless intentionally granted.
• App install hygiene: Use Google Play only; enable Play Protect scanning under Settings → Security → Google Play Protect.

Monthly check routine

• Check for pending OS and app updates; install any that are overdue.
• Review installed apps and remove anything unfamiliar.
• Check active sign-in sessions in your Google or Apple ID account and revoke unknown devices.
• Review account sign-in alert emails from the previous month.

Recovery Options and Backup Access

Recovery-hardening matrix

Account	Backup codes	Recovery contact	Change alerts
Carrier account	N/A (use PIN + number lock instead)	Verify recovery email is not the at-risk line; use alternate number or hardware key	Enable login alerts in carrier app or portal
Apple ID / iCloud	Generate and store recovery key; print or save to offline password-manager vault	Recovery phone must not be the SIM-swap-vulnerable number; add a trusted person as Account Recovery Contact	Enable email alerts for Apple ID sign-in at appleid.apple.com
Google Account	Generate backup codes; store offline (printed in a safe or password-manager vault)	Recovery phone must not be the SIM-swap-vulnerable number; prefer passkey or hardware key as recovery method	Enable “Security alerts” emails; review at myaccount.google.com/security
Primary financial accounts	Follow institution’s process for backup/one-time codes; store offline	Use an out-of-band contact method (not the at-risk number); prefer app-based or hardware-key 2FA	Enable transaction and login alerts via app settings or email

Avoiding circular dependencies

If SMS is used for account recovery and your number is compromised in a SIM swap, recovery fails at the exact moment you need it most. This is not a theoretical risk—it is the standard SIM swap attack chain. Build your recovery stack to avoid this loop:

• Primary: Passkey or hardware security key
• Secondary: Authenticator-app TOTP
• Tertiary: Backup codes stored offline (not in your email inbox)

Remove SMS as a recovery option wherever the service allows it. If SMS cannot be removed, add stronger factors above it and treat SMS as a last resort only.

Network Security Practices (Wi‑Fi, VPN, DNS)

Credential theft over a network is the main network-related pathway into your accounts. Attackers on the same public Wi-Fi network can intercept unencrypted traffic, inject malicious content, or redirect you to phishing pages. The controls below are targeted specifically at preventing that path.

• Avoid sensitive account actions on unknown public Wi‑Fi networks. Do not log into your carrier account, primary email, or any banking app on airport, hotel, café, or transit Wi‑Fi.
• If public Wi‑Fi is unavoidable, use a reputable VPN before opening any sensitive app or browser tab. Choose a VPN provider with a published no-logs policy and independent audit. Enable the VPN’s kill switch so your connection drops rather than falling back to unprotected traffic.
• Prefer cellular data for sensitive changes. Switching to mobile data (your carrier’s network) when making carrier account changes, updating passwords, or reviewing 2FA settings removes the public Wi-Fi threat entirely.
• Never bypass HTTPS warnings. If your browser shows a certificate error or “Your connection is not private” warning on a site where you intend to log in, stop. Do not proceed; the site may be intercepting your credentials.
• Enable encrypted DNS (Private DNS) on your device. On Android (Google Pixel, Samsung Galaxy, and others), go to Settings → Network & Internet → Private DNS and enter a trusted resolver hostname (e.g., dns.google or 1dot1dot1dot1.cloudflare.com). On iOS (Apple iPhone), install a DNS configuration profile from a trusted provider or use an app that enables encrypted DNS via the system network extension. This prevents DNS-based redirects on otherwise legitimate Wi‑Fi networks.

Verification and Monitoring

Alerts to enable (set once)

1. Carrier account login alerts — enable in your carrier’s app notification settings or security section
2. Carrier-sent SIM change / line transfer notifications — confirm with your carrier that these are active
3. Primary email sign-in alerts — enable in your email provider’s security settings
4. Google Account or Apple ID new-device sign-in alerts — enabled by default; verify in account security settings
5. Bank and credit card login alerts — enable in each institution’s app
6. Bank transaction alerts for amounts above a low threshold (e.g., any transaction over $1)
7. Credit monitoring alerts (new account opened, hard inquiry) — via free annual credit report services or your bank’s monitoring feature

Monthly review routine

1. Open each alert source (carrier app, email, bank) and scan for unrecognized sign-ins or changes from the prior 30 days.
2. Check for any installed apps, authorized devices, or connected third-party apps you don’t recognize; remove them.
3. Verify OS and app updates are current (see the monthly check routine above).

Respond immediately to these signals

If you lose cell service unexpectedly, receive a “SIM changed” notification, get an unexpected password-reset email, or notice an unrecognized device in your account list, treat it as an active incident:

1. Call your carrier immediately from a different phone or Wi-Fi calling and ask them to freeze your account and confirm current SIM status.
2. Change your primary email password from a trusted device on a secure network and revoke active sessions.
3. Alert your bank to watch for unauthorized transactions and consider a temporary freeze if access has been lost.

Traveler Security (International Use)

ENISA’s baseline remains a helpful anchor: there have been very few reported cybersecurity breaches involving eSIMs in Europe since 2010. The embedded chip itself is remarkably resilient. What tends to fail under travel stress is everything around it — account recovery, network choices, and device hygiene when you’re tired, offline, or rushing to make a payment.

That’s the lens for this playbook: keep the eSIM benefits, remove the most common traveler pitfalls.

Using eSIMs Abroad: Practical Safety Checklist

Before You Depart

• Carrier-account hardening: Set a carrier PIN and enable a port lock (or number lock) on your account before you leave. SIM/eSIM swap attempts are frequently timed for when you’re abroad and less able to respond quickly — a port lock makes it significantly harder for attackers to hijack your number while you’re distracted or in a different time zone.
• Device settings: Confirm your eSIM profile is active and correctly configured. On iPhone, go to Settings → Cellular and verify the correct plan is set as the primary data line. On Android, check Settings → Network & Internet → SIMs. Disable auto-join for unknown Wi-Fi networks now, before you need to think about it at the airport.
• App/account access: Log into your banking apps and any account that uses SMS-based 2FA before you travel. Generate and securely store backup authentication codes (most authenticator apps and services offer these under “account recovery” or “backup codes”). Save them somewhere offline — a password manager with offline access, or a printed copy stored separately from your phone.
• Connectivity hygiene: Download offline maps (Google Maps, Maps.me) and save any essential documents locally. Don’t rely on being able to pull critical information from the cloud the moment you land.

Connectivity Resilience Mini-Block:

• Offline backup: Print or locally store emergency contact numbers, your accommodation address, and your carrier’s international support number. If your eSIM data fails and you can’t get on a safe network, you won’t be forced onto risky public Wi-Fi just to find a phone number.
• Authentication fallback: Store your backup codes for email, banking, and any critical accounts in an encrypted, offline-accessible format. Authenticator app codes work without data — make sure the app is installed and synced before departure.
• Communications fallback: Identify a secondary messaging channel that works over Wi-Fi (WhatsApp, Signal, iMessage over Wi-Fi) so that if your eSIM data fails, you have a way to communicate without defaulting to an unvetted public WiFi network for sensitive tasks.

On Arrival

• Carrier-account hardening: The moment you get a signal, send a quick test message or check your carrier app to confirm your eSIM profile roamed correctly and you’re on a supported carrier partner network (not an unrecognized third-party network).
• Device settings: Check that data roaming is enabled intentionally — not because the phone defaulted to it silently. On iPhone: Settings → Cellular → Roaming. On Android: Settings → Network & Internet → Mobile Network → Roaming. Confirm the APN settings are from your legitimate carrier profile, not something that got pushed without your notice.
• App/account access: Open your email and one banking app to verify they’re accessible. If you get locked out, it’s far better to discover and resolve that while you still have hotel Wi-Fi and time, rather than on the street needing to make a payment.
• Connectivity hygiene: Keep mobile data on for sensitive tasks. Reserve public Wi-Fi for low-stakes browsing only (and even then, with the constraints outlined below).

If Something Goes Wrong

• If you’re locked out of an account and can’t receive SMS codes, use your pre-stored backup codes. If those are also inaccessible, contact the service’s account recovery process — do this over your eSIM cellular data, not public Wi-Fi, if the matter is sensitive.
• If your eSIM data stops working entirely, contact your carrier via their app (which may cache some functionality) or their international support number (which you saved offline, right?). Avoid jumping onto the nearest open Wi-Fi network to “just quickly check something” sensitive.
• If you suspect your carrier account has been tampered with (unexpected account change notifications, suddenly no signal where there should be), contact your carrier immediately and ask them to check for any recent eSIM profile changes or port requests you didn’t initiate.

eSIM vs Public Wi-Fi vs VPN

Decision Framework: Which Connectivity Option, When?

1. When eSIM cellular data is safer than a public WiFi network

eSIM cellular data is the default safe choice for anything sensitive: banking, email, account changes, 2FA confirmations, or anything that involves a password.

The connection goes from your device directly to your carrier’s encrypted cellular infrastructure there’s no shared access point that a stranger in the same coffee shop can see or manipulate.

Factor	eSIM Cellular	Public Wi-Fi
Primary risks mitigated	Rogue access points, network eavesdropping, SSID spoofing	Cost (when data is expensive)
Risks not mitigated	Malicious apps on your device, compromised carrier infrastructure (rare)	Rogue APs, eavesdropping, SSID spoofing, captive portal phishing
Behaviors that reintroduce risk	Downloading unvetted apps, ignoring certificate warnings	Nearly everything sensitive

Use eSIM cellular data by default for all sensitive tasks during international travel.

2. When public Wi-Fi is acceptable (with specific constraints)

Public Wi-Fi is acceptable only for genuinely low-stakes activity: reading news, streaming video when you don’t care about privacy, or downloading large app updates you’ve already verified. The constraints that must be in place:

• You are not entering any passwords, accessing any financial accounts, or confirming any authentication requests.
• You have verified the exact network name with a staff member at the venue (not just connected to whatever appears strongest).
• You are treating the network as fully observable by a third party — because it might be.

Factor	Public Wi-Fi (with constraints)
Primary risks mitigated	Cellular data costs for large, non-sensitive transfers
Risks not mitigated	SSID spoofing, rogue access points, captive portal phishing, local eavesdropping
Behaviors that reintroduce risk	Logging into anything, assuming a VPN makes it fully safe

3. What a VPN does — and does not — protect against while traveling

A VPN encrypts the traffic between your device and the VPN server. That’s useful: it prevents someone on the same network access point from reading your traffic in transit. It does not:

• Validate that the Wi-Fi network access point you connected to is legitimate.
• Prevent captive portal phishing (a fake login page that appears before the VPN tunnel is established).
• Protect you if you’ve already connected to a rogue network — your device still made that initial handshake.
• Secure accounts where the threat is at the account level (credential stuffing, phishing sites).

Factor	VPN on Public Wi-Fi
Primary risks mitigated	In-transit traffic eavesdropping on a legitimate network
Risks not mitigated	Rogue AP connection, captive portal phishing, account-level attacks, pre-tunnel exposure
Behaviors that reintroduce risk	Assuming VPN = safe, skipping network verification before connecting

Common Misconception: “I’m using a VPN, so public Wi-Fi is fine.”

A VPN does not confirm you are connected to a legitimate Wi-Fi access point, and it does not prevent captive portal phishing the fake login page appears before your VPN tunnel is even established.

Example scenario: At an international airport, you see two networks: “Airport_Free_WiFi” and “AirportFreeWifi.”

One is the real network. One is an attacker’s hotspot set up to look identical. Your VPN won’t tell you which is which.

The check that would have prevented this: ask airport staff (or check the official airport app/website) for the exact SSID before connecting then verify the name character by character.

If the network immediately redirects you to a login page asking for personal information beyond a basic email, disconnect.

Roaming, Network Selection, and Fake Networks

Threat & Mitigation Grid

Threat	What It Means in Practice	Device-Level Mitigation
Rogue base stations / IMSI-catcher-like risks	Devices that mimic legitimate cell towers can force nearby phones to connect, potentially intercepting unencrypted communications. This is largely a concern in specific high-risk environments (protests, certain border areas).	Use a carrier-provided eSIM with a reputable carrier — connections via established carrier infrastructure use encryption layers that make passive interception significantly harder. Avoid 2G-only fallback where possible (2G has weaker encryption).
Fake carrier networks	A network may present itself with a legitimate-looking carrier name but not be affiliated with your carrier’s roaming partners.	In your phone’s manual network selection (Settings → Cellular → Network Selection on iPhone; Settings → Network & Internet → Mobile Network → Choose Network on Android), verify the network name matches your carrier’s documented roaming partners before connecting manually. When in doubt, revert to automatic selection.
Misleading network names	Network names (SSIDs for Wi-Fi, or displayed carrier names) can be spoofed or coincidentally similar to legitimate networks.	Disable auto-join Wi-Fi for any network your phone hasn’t explicitly verified. On iPhone: tap the (i) next to a network → disable “Auto-Join.” Review the carrier name displayed in your status bar against your carrier’s roaming partner list.

Red flag that should trigger immediate disconnection: If you notice your phone has connected to a network you didn’t select, or if the carrier name in your status bar changes unexpectedly without crossing a border disconnect immediately, enable airplane mode, then selectively re-enable cellular only.

Investigate before reconnecting to data.

Landing-Mode Hygiene: First 5 Minutes in a New Country

The moment you disable airplane mode after landing, run this quick sequence before doing anything else:

1. Confirm active eSIM profile: On iPhone → Settings → Cellular → confirm the correct plan shows “On” and is set as the data line. On Android → Settings → Network & Internet → SIMs → confirm correct profile is active.
2. Confirm data roaming state: Verify roaming is enabled intentionally and shows the expected carrier name (matching your carrier’s roaming partners, not an unfamiliar network).
3. Validate APN/profile source: If your phone prompts you to install a new profile or configuration, do not accept it unless you initiated that action through your official carrier app or a legitimate QR code provided directly by your carrier.
4. Verify primary accounts still work: Open email, then one other critical account. If something is locked or behaving unexpectedly, you want to know now — with time to fix it — not an hour later when you need it urgently.

Any silent misconfiguration (wrong APN, unexpected network, unfamiliar carrier name) is worth pausing to investigate rather than assuming it will sort itself out.

Public Charging and “Juice Jacking” Risk

Public USB charging stations — at airports, hotels, and cafes — are convenient.

They can also become an avoidable risk, especially when you’re tired and just want power quickly. The good news is the defense is simple and reliable.

(a) Charging-Only Risk Controls

These reduce the risk of hardware-level interference even if you’re using a “safe” cable:

• Use a wall outlet with your own charger. A standard AC outlet with your own USB-A or USB-C power brick eliminates the USB data pathway entirely. This is the single most effective control.
• Use a power-only cable or USB data blocker. If you must use a public USB port, a “charge-only” cable (with data wires removed) or a USB data blocker dongle (sometimes called a “USB condom”) inserted between your cable and the public port physically blocks any data transfer.

(b) Data-Transfer Risk Controls

These address the scenario where a data-capable connection is made — whether by accident or because you only had a standard cable:

• Never tap “Trust This Computer” / “Allow” when your iPhone or Android device prompts you after connecting to a USB port. If you see this prompt at a public charging kiosk, tap “Don’t Trust” / “Decline” immediately and consider switching to a different power source.
• This prompt appearing at a charging-only kiosk is itself a red flag. Legitimate charging stations don’t initiate data handshakes.

Quick kiosk decision checklist (30 seconds):

1. Is there a wall outlet? → Use it with your own charger. Done.
2. Only USB port available? → Use a data blocker or charge-only cable.
3. No data blocker, standard cable only? → Plug in, and immediately decline any “Trust” prompt. Watch for any unusual behavior (unexpected notifications, screen activity).
4. Unexpected prompt appears? → Disconnect immediately.

If You Already Plugged In

Immediate steps:

• Disconnect from the charging port now.
• If a “Trust This Computer” or “Allow USB Accessories” prompt appeared, tap Don’t Trust / Decline if it’s still on screen.

Follow-up steps:

• iPhone: Settings → General → VPN & Device Management — check for any profiles you don’t recognize. Settings → Privacy & Security → review recently accessed items if anything seems off.
• Android: Settings → Connected Devices (or USB Preferences) — review any listed trusted devices or USB debugging authorizations.
• Monitor for unexpected behavior over the next 30–60 minutes: unusual notifications, apps opening themselves, battery draining faster than normal, or prompts you didn’t initiate.

If you observe active anomalies — not just “I feel anxious about it” but actual unexpected system behavior proceed to your device’s incident response steps (covered in the dedicated IR section).

Frequently Asked Questions

Can eSIMs Be Hacked?

It depends — but the real risk is rarely the eSIM chip itself. There are three distinct attack surfaces to understand: (a) carrier account / remote provisioning flow (e.g., a bad actor socially engineers your carrier to reassign your number), (b) device compromise via malware or spyware that intercepts data at the OS level, and (c) network interception on rogue Wi-Fi that exploits weak security protocol handling.

A common misconception: physical inaccessibility does reduce certain risks (no one can yank your SIM), but it does not prevent account-takeover-driven swaps.

ENISA has reported very few publicly documented cybersecurity breaches involving eSIMs in Europe since 2010 — but low reported incidents ≠ impossibility; most real-world cases are account takeovers, not eSIM chip breaches.

Risk signal checklist — flag these immediately:

• Sudden, unexplained loss of cellular service
• Unexpected carrier notifications about profile or number changes
• Unfamiliar devices appearing in your carrier account
• Authentication codes arriving for actions you didn’t initiate

If you spot any of these, go directly to the Incident Response section for step-by-step actions.

Do eSIMs Support Personal Hotspots?

Yes — but three gating factors determine whether it actually works. Carrier policy is the first hurdle: some carriers block hotspot/tethering at the plan level regardless of device capability.

cellular plan type matters too — prepaid and eSIM for international travel plans frequently restrict tethering even when the carrier support page implies otherwise.

OS toggles are the third factor: both iOS and Android have a Personal Hotspot setting that must be explicitly enabled, and incorrect APN/profile settings can silently block it.

Troubleshooting decision tree:

1. Check your plan supports tethering — log into your carrier account or contact carrier support directly.
2. Confirm APN/profile settings — a QR code re-download or manual APN entry sometimes resolves hidden blocks.
3. Verify OS hotspot permissions/settings — on iOS, toggle Personal Hotspot off and back on; on Android (Google Pixel, Samsung Galaxy), confirm the hotspot toggle is active under network settings.

Security note: Set a strong, unique hotspot password and use WPA2/WPA3 where available. Disable the “Allow Others to Join” (iOS) or equivalent auto-join setting so nearby devices can’t connect without active approval — this prevents unintended sharing without requiring a full OS walkthrough.

What Extra Security Settings Can I Enable?

Several targeted settings meaningfully reduce eSIM and number-takeover fallout without repeating the general 2FA guidance covered in the Best Practices section (apply that specifically to your carrier account and your Apple or Google account, including any paired devices like Apple Watch, and eSIM-capable tablets such as iPad Pro that may share credentials and recovery pathways).

Settings shortlist (iOS & Android combined):

• Passcode/biometric hardening — use a 6-digit+ alphanumeric passcode; disable simple passcode on iPhone or pattern unlock on Android
• eSIM/SIM change alerts — check your carrier account settings; some carriers offer notifications when a profile transfer or QR code scan is initiated
• Account recovery hardening — review and restrict backup recovery options on both your Apple ID and Google account to reduce takeover vectors
• Lock screen privacy — disable message and notification previews on the lock screen (iOS: Settings → Notifications → Show Previews → “When Unlocked”; Android: similar under Lock Screen settings)
• Screen lock timeout — set to 30 seconds or less when traveling

For provider-selection specifics, see Choosing an eSIM Provider Safely.

Travel mode — quick toggles:

• Disable Wi-Fi auto-join for unknown networks before you arrive at your destination
• Confirm your VPN activates automatically on public networks
• Set lock screen notification previews to “hidden” for the duration of your trip