Is an eSIM more secure than a physical SIM?

The stolen phone: where the eSIM clearly wins

A physical SIM is a card in a tray. Whoever holds the phone can take it out and put it in another device, and from then on your calls and texts, verification codes included, can reach them. That is why the SIM PIN exists: Apple describes it as a code that stops other people using your SIM or eSIM for calls and mobile data, and it locks the line after a restart or when the card is removed.

An eSIM leaves nothing to take out. Apple states that an eSIM is more secure than a physical SIM because it cannot be removed if the iPhone or iPad is lost or stolen. A thief would have to get into the phone's settings to delete or move it, which brings the screen lock and the theft protections into play, as covered in Stolen Device Protection and Android theft protection.

How the profile reaches your phone

The other worry is whether the download can be intercepted. The GSMA, the mobile industry body that writes the eSIM specifications, requires the connection between the phone's eSIM chip and the provider's profile server, called the SM-DP+, to use TLS, the same encryption behind https web pages. Both ends have to be certified: the GSMA's Security Accreditation Scheme audits the sites where eSIM chips are produced and the operation of the servers that hand out profiles.

On top of that, the chip's software is certified against a GSMA protection profile designed to safeguard sensitive information and prevent unauthorised access, and certified products receive a certificate they use to authenticate each other. When researchers at Aalto University in Finland analysed the provisioning protocol, the GSMA's response was that it was adequately secured between honest parties, and that the attack scenarios assumed one end was already compromised.

SIM swaps: the format does not save you

A SIM swap never touches your phone. The criminal convinces your operator, or someone working there, to move your number elsewhere. The Canadian Centre for Cyber Security defines it as transferring your number to a threat actor's SIM card or eSIM without your knowledge, and adds that because eSIMs can be generated and transferred electronically, they can also make social engineering and remote attacks easier.

So moving your home line to an eSIM does not, on its own, close that door. The agency's advice is about the account: ask the provider to turn on port protection or a SIM lock if it offers one, use any extra verification it has, and prefer sign-in methods that do not depend on your phone number. What to set up before a trip, and what to do if your line goes dead abroad, is in SIM swap fraud while travelling.

The eSIM's one exposed moment: the QR code

With a card, the risk is someone taking it. With an eSIM, the delicate moment comes before installation, while the QR code is out in the world. The code points to one specific profile on the provider's server, and a single-install eSIM goes to the first phone that uses it. A screenshot in a group chat or a printed email left on a desk is enough to lose it.

Once the profile is on your phone, that risk is over: the code cannot pull it back out of your device. The practical rules, from scanning it yourself to what to do if someone else got there first, are in keep your eSIM QR code private. A data-only travel eSIM, like the ones Snoozim sells, adds one nuance: it has no phone number, so it is not what a SIM swapper is after, although your home line still is.

Settings that make either kind safer

• Put a SIM PIN on your home line, in Settings, Cellular on an iPhone. Apple warns not to guess it, because that can end up locking the SIM or eSIM permanently, so ask your operator for the default first.
• On a Pixel, turn on Confirm SIM deletion under Settings, Security, Advanced, so nobody can erase an eSIM without your password.
• Turn on Stolen Device Protection on iPhone, or the Theft protection settings on Android.
• Ask your operator about a SIM lock or port protection on your account.
• Move important logins from text codes to an authenticator app or passkeys.

None of these depends on whether the line is a card or an eSIM, and that is the real answer to the question: the format changes the theft risk, the settings handle everything else. Our guide to two-factor authentication on a trip covers the last point.