eSIM swap scams: how eSIM technology changes the SIM-swapping playbook

Your phone number is more than a way to reach you. It's the master key to your bank account, your email, your crypto wallet, and every other account that sends a verification code to your phone. SIM swap fraud has exploited that reality for years. Now, with eSIM technology going mainstream, the attack has quietly evolved.

eSIMs were supposed to make things safer. In some ways, they do. But scammers have found new angles, and the mechanics of an eSIM swap are different enough from the classic physical SIM swap that many people don't recognize what's happening until it's too late.

What is a SIM swap scam?

A SIM swap scam is when someone convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, every call and text meant for you goes to them instead, including the one-time codes used to verify your identity on banking, email, and social media accounts.

The damage can be swift, though it isn't always permanent. A bank customer in Carlsbad, California, lost $38,000 in three overnight wires after a fraudster tricked Xfinity Mobile into moving his number, according to ABC 10News. He eventually got the money back from his bank and a brokerage, but only after a months-long fight. In March 2025, an arbitrator ordered T-Mobile to pay $33 million to a customer whose cryptocurrency was stolen in a 2020 SIM swap, after finding the carrier failed to protect his account information, SecurityWeek reports.

The FBI's Internet Crime Complaint Center received 1,075 SIM swap complaints in 2023, with reported losses of about $48.8 million (FBI IC3). Complaints then stayed near 1,000 a year, at 982 in 2024 and 971 in 2025, while reported losses fell to about $26 million and $17.4 million (FBI IC3, 2025 report). Other countries report sharper increases. Australia's IDCARE reported a 240% rise in phone-porting and SIM swap cases it handled in 2024 versus 2023, with 90% of those events happening without the victim's involvement. Cifas reported a 1,055% rise in unauthorised SIM swap cases filed to the UK National Fraud Database in 2024, to almost 3,000.

A SIM swap is one of several ways scammers steal an identity, so it helps to know the basics of preventing identity theft and how to spot spam calls and scam texts.

What is an eSIM, and why does it matter for this scam?

An eSIM (embedded SIM) is a small chip soldered directly onto your phone's motherboard. Unlike a physical SIM card, it can't be removed or swapped by hand. Instead, carrier profiles are loaded onto it digitally, over the air, using QR codes or carrier apps.

That digital provisioning process is exactly what attackers have learned to exploit.

With a physical SIM swap, a fraudster typically had to walk into a store or call customer service and persuade an agent to issue a new card. With eSIM, the swap can happen entirely online through a carrier's web portal, once the attacker has control of your account credentials.

How an eSIM swap attack actually works

The classic social engineering approach, where an attacker impersonates you at a carrier store or over the phone, hasn't disappeared. But in March 2024, researchers at FACCT (a Russian cybercrime prevention firm) warned of another method that doesn't require talking to a carrier agent, after seeing more than 100 attempts against a single financial institution. Frank on Fraud summarizes how it works in five steps:

Step 1: Gather your personal information. Attackers collect your name, address, date of birth, and phone number. This data often comes from phishing emails, data breaches, or information sitting in public records.

Step 2: Take over your carrier account. Using stolen or leaked credentials, including through credential stuffing, where leaked username and password combinations are tested at scale, attackers log into your mobile carrier's online portal. They don't need to talk to anyone.

Step 3: Request an eSIM transfer. Once inside your account, the attacker initiates a request to migrate your phone number to a new eSIM. The carrier's portal generates an activation QR code for the "replacement device."

Step 4: Scan the QR code on their device. The attacker scans that code on a phone they control. Your number is now provisioned to their eSIM.

Step 5: Intercept everything. Your phone loses signal. Their device starts receiving your calls and texts, including every SMS verification code sent by your bank, email provider, or any other account tied to your number.

The key shift here is that attackers have added a path that doesn't need a carrier employee: a leaked password can be enough to start the transfer. Leaked credential databases circulate widely, and attackers test them against many kinds of accounts, so your carrier account is a target too.

The eSIM cloning risk you haven't heard about

Taking over a carrier account is the route that has been seen in real attacks, but there's a more technical angle worth knowing. In July 2025, Security Explorations (AG Security Research) published findings showing it had broken the security of a Kigen eUICC, the chip that stores eSIM profiles.

By exploiting a flaw in the Java Card Virtual Machine, the researchers extracted a private key from the tested chip and used it to download eSIM profiles from several carriers, including AT&T, Vodafone, O2, Orange, and T-Mobile, in unencrypted form. The research was widely covered, including by Cybersecurity News.

This was a lab attack, not a sign that your eSIM is easy to clone. Kigen says it required physical access to the chip and publicly known test-profile keys, and that most eUICCs are not vulnerable. The researchers dispute that physical access is the only route and say a remote attack can't be excluded. Kigen says its operating system enables more than 2 billion SIMs, but that is not a count of vulnerable devices. Kigen deployed a patch, GSMA updated its test-profile specification, and no real-world exploitation has been reported (Kigen security bulletin).

The real-world cost: what attackers are after

The end goal of an eSIM swap is the same as a traditional SIM swap: getting past SMS-based two-factor authentication (2FA).

A high-profile example is the 2022 theft of more than $400 million in crypto from a company widely reported to be FTX. A 2024 US indictment alleges the thieves SIM swapped an employee's phone number and used the authentication codes they intercepted to reach the company's online accounts and move the funds, according to Krebs on Security. The indictment doesn't name FTX, and its claims are allegations.

Your account probably doesn't hold $400 million. But the same technique works on anyone relying on SMS codes for authentication: bank accounts, email, cryptocurrency exchanges, and social media. High-net-worth individuals and crypto holders are priority targets, but ordinary accounts get hit too.

Warning signs that your number may have been swapped

The most reliable early signal is a sudden loss of mobile service when people around you on the same network have no issues. Other signs to watch for:

• You can't make calls or send texts. Your phone shows no network, even in an area with good coverage.
• Unexpected account notifications. Emails or texts about password resets, account changes, or login attempts you didn't make.
• Carrier alerts about account changes. Some carriers send notifications when an eSIM transfer is requested; pay attention to these.
• You stop receiving calls that others say they made to you. Your number is routing somewhere else.

If any of these happen, contact your carrier immediately. The faster you report the issue, the smaller the window an attacker has to use your number.

How to reduce your risk

No single step eliminates the threat, but combining a few of them makes you a much harder target.

Set a carrier account PIN or passphrase. Most major carriers let you add a PIN to your account that must be provided before any changes, including SIM transfers, can be made. This is a simple, effective protection, and it's often not set by default.

Turn on your carrier account lock. Several US carriers offer tools that block SIM and eSIM changes or number transfers until you switch them off, such as T-Mobile's SIM Protection and Port Out Protection, Verizon's SIM Protection and Number Lock, and AT&T's Wireless Account Lock. Check your carrier's account settings, because features and names change.

Move away from SMS-based 2FA. If a service offers an authenticator app (like Google Authenticator or Authy) or a hardware security key, use it instead of SMS verification. Codes generated by an app or key aren't tied to your phone number, so a SIM swap alone can't intercept them. Remove SMS as a backup or recovery option where the service allows it, since a text message can still reset the account.

Use strong, unique passwords for your carrier account. If your carrier portal credentials are in a leaked database, credential stuffing works. A strong, unique password closes that door. A password manager makes this easy.

Be careful with your personal information. The raw material for these attacks, your name, date of birth, address, and phone number, comes from phishing scams and data breaches. Be selective about where you share it, and run periodic checks to see if your details have appeared in known breaches.

Enable alerts for account changes. Turn on notifications for any changes made to your carrier account. Getting a heads-up the moment someone requests an eSIM transfer gives you a chance to act before they do.

Does having an eSIM actually protect you?

Partly. The eSIM does remove one physical vulnerability: a thief who gets hold of your phone can't pull out the SIM card and put it in their own device. That's a real protection against device theft.

But it doesn't protect against remote attacks. As Frank McKenna notes, remote attackers only need to persuade your carrier or compromise your account to transfer your calls and messages to a device they control. The eSIM's digital provisioning model can even make the swap faster, since everything happens through an online portal rather than requiring a physical card to be mailed or picked up.

The honest answer is that eSIM technology shifts some risks while creating new ones. It's a step forward, not a finish line.

What to do if it happens to you

If you suspect a SIM swap has occurred, act quickly:

1. Call your carrier from a landline or a different phone. Report the unauthorized transfer immediately and ask them to lock your account.
2. Change your passwords. Start with your email and banking accounts since those are typically the first targets.
3. Contact your bank. Alert your financial institution so they can flag your account for suspicious activity.
4. File a report with the FTC at reportfraud.ftc.gov and with the FBI's Internet Crime Complaint Center at ic3.gov.
5. Check your accounts. Look for unauthorized transactions or changes made during the window when your number was compromised.

The faster you move, the better. Attackers can start resetting your accounts as soon as the number moves.

Conclusion

Your phone number is a bigger part of your digital identity than most people realize. Protecting it means locking down your carrier account, reducing your reliance on SMS-based verification, and knowing the warning signs before they hit. Guardio doesn't secure your carrier account, but it covers a related risk. Browsing protection on your computer and phone blocks phishing sites before they open and explains why, and identity protection monitors your email address and phone number for dark web exposure. No tool catches everything.

Get a free security scan with Guardio today.