Can an eSIM be hacked?

No practical remote attack on the chip is publicly known, and profiles are delivered over an encrypted, mutually authenticated process. Nothing is beyond all attack, though: the realistic risks are phishing and stolen QR codes, which target you rather than the technology.

Is an eSIM safer than a SIM card?

Slightly, in one narrow way: it cannot be pulled out of a stolen phone and used elsewhere. Otherwise the two are comparably secure, and the attacks that matter, like SIM-swap fraud, target carrier accounts and affect both formats equally.

Can an eSIM track my location?

No more than any SIM. Mobile networks locate every connected phone at cell-tower level as part of how they work, identically for eSIM and plastic. The eSIM standard adds no extra tracking channel and gives the seller no view of your movements.

Can airport security see my eSIM?

There is no equipment that reads profiles off your phone's chip at a gate or border. An officer inspecting your unlocked phone could see the eSIM list in Settings, exactly as they could see a plastic SIM in the tray.

Should I delete my eSIM before selling my phone?

Yes, always: remove every profile in Settings before a sale, trade-in or repair handover, just as you would sign out of your accounts. A factory reset removes profiles on most phones too, but checking the eSIM list takes seconds.

What is SIM-swap fraud and does an eSIM prevent it?

It is a criminal convincing a carrier to move your number to their device, attacking the account rather than the chip, so no SIM format prevents it. Your defences are a strong carrier account password, a PIN with your carrier, and scepticism toward unexpected messages.

eSIM security: myths vs the real risks

The short answer

An eSIM is broadly as secure as a plastic SIM, and most of the scary claims about it are myths. But honest means honest in both directions: no technology is beyond attack, and there are a few real precautions worth taking. This article sorts the common worries into two piles: the myths you can stop losing sleep over, and the genuine habits that actually protect you. None of them require technical skill; most amount to treating a QR code with the same care as a password.

Myth: eSIMs can be hacked remotely

Remotely breaking into the chip is not the realistic threat; tricking you is. eSIM profiles are delivered over the GSMA's standardised process, in which the server and the secure chip authenticate each other and the profile travels encrypted. Nothing is ever provably unhackable, and researchers keep probing every system, but there is no known practical attack where a stranger simply installs or steals a profile on your phone over the air. The attacks that actually happen are old-fashioned: phishing emails, fake provider websites, and stolen QR codes. The weak point is human, not the chip.

Myth: an eSIM tracks you more than a SIM

An eSIM adds no tracking that a plastic SIM does not already have. Any phone connected to any mobile network can be located by that network at the level of cell towers; that is simply how mobile networks route your calls and data, and it works identically for both SIM types. The eSIM standard adds no extra location channel, no hidden reporting, and no way for the profile seller to watch your movements. If network-level location is your concern, the honest answer is that it comes with owning a phone, not with choosing an eSIM.

Myth: airlines and borders can read your eSIM

No. There is no scanner at a gate or border desk that reads the profiles on your phone's chip. Profiles sit inside the eUICC, the secure chip, and are not broadcast for nearby equipment to browse. What a border officer can do is what they could always do: ask to see your unlocked phone, where your eSIM list is visible in Settings like any other setting. That is a question of local law and your own choices at the border, and it applies equally to a plastic SIM sitting in the tray.

Myth: you can't remove an eSIM

You can delete an eSIM profile whenever you like, straight from Settings. The chip stays in the phone (it is soldered in), but the profile on it is yours to remove in a few taps. The honest caveat: deletion is often permanent. Because the original QR code was consumed at install, a deleted profile usually cannot be re-added without the provider reissuing it. So the myth is backwards: removal is easy, and the real advice is to not delete a profile with data or validity remaining unless you mean it.

The real risks worth guarding against

Three habits cover the genuine risks. First, guard an unused QR code like a password: whoever redeems it first owns the profile, so do not post it, forward it or leave it in a shared inbox. Second, delete your profiles before selling or handing over a phone, the same way you would sign out of your accounts. Third, know that SIM-swap fraud (a criminal persuading a carrier to move your number) attacks your carrier account, not the chip, so a strong account password and a carrier PIN protect you more than any SIM format ever will. A reputable provider, like Goodbars, will also only ever deliver your eSIM to the email you bought with, never through links in unexpected messages.

eSIM security: the myths and the real risks