Can an eSIM Be Hacked? SIM-Swap, QR Code and Account Security

An eSIM can be secure at the device level, but it does not stop SIM-swap, port-out, phishing, or weak account controls. The real risk usually comes from carrier-account takeover and unsafe handling of activation details, not from the eSIM chip itself.

What an eSIM is and what “hacked” usually means

GSMA says an eSIM is a SIM that can be securely downloaded into a Secure Element permanently embedded in the device, and that it offers an equivalent level of security and protection to a removable SIM card. Its overview also says eSIM is the globally backed remote SIM specification for consumer devices, and that the subscription can be loaded into the device without a physical card.

That means a hacker usually does not “hack the eSIM” in the sense of breaking the embedded hardware. The practical attack is more often on the mobile account, the activation process, or the phone number itself.

SIM-swap and port-out attacks are the main threat

The FTC's SIM-swap guidance says scammers may try to get enough personal information to take over a cellular account and move your number to another SIM or device. It recommends setting a PIN or password on the cellular account and warns that text-message verification may not stop a SIM swap.

The FTC also says to use stronger authentication for sensitive accounts, and if SIM swapping is a concern, use an authentication app or a security key instead of SMS-based verification. If your number is taken over, contact the cellular provider immediately, then change account passwords after you regain access.

Set a PIN or password on the cellular account.
Do not trust incoming calls, emails, or texts asking for personal information.
Use an authentication app or security key for important accounts.
Contact the carrier immediately if the number stops working.

Activation codes and QR codes need the same care as passwords

eSIM activation usually depends on carrier-provided enrollment details, such as a QR code or another provisioning method. If someone gets that activation information, they may be able to load the line onto a different device, depending on the carrier’s process.

That is why activation codes should be treated like account credentials. Do not post them, forward them, or leave them visible in email inboxes, screenshots, or shared documents. If a provider gives a one-time code or QR code, use it only through the provider’s official setup flow.

What the published sources say eSIM protects against

GSMA says eSIM is designed for secure download into an embedded Secure Element and that the ecosystem was created to support trusted platforms and players. The GSMA overview and related material describe an equivalent level of security to a removable SIM card, not a guarantee against account abuse.

FCC guidance says embedded SIMs are hardwired inside newer phones, so they are not removable, which eliminates some physical SIM-swap risk. It also says port-out scams remain a security concern, and consumers should wipe eSIM data when replacing phones.

That distinction matters: eSIM security facts describe protection at the SIM storage level, while account controls determine whether someone can still redirect your number.

Practical steps that reduce risk

Use carrier account protections first, then lock down the phone and your online accounts. The strongest protection comes from using more than one layer.

Ask the carrier for a PIN or password on the mobile account.
Prefer authentication apps or security keys over SMS for important accounts.
Watch for unexpected service loss, password-reset prompts, or SIM-change notices.
Keep activation QR codes and setup emails private.
Wipe the eSIM from old phones before recycling, selling, or trading them in.
Contact the carrier through a known official channel if anything looks wrong.

Bottom line

An eSIM is not inherently easy to hack, and the embedded profile is designed to be securely downloaded and stored. The bigger risk is still someone tricking the carrier, stealing activation details, or using phishing to reach your accounts. In practice, the safest setup is a protected carrier account, non-SMS two-factor authentication, and careful handling of every eSIM activation code.

For additional first-party detail relevant to this topic, consult GSMA's eSIM overview.

More eSIM resources: Browse our eSIM guides and troubleshooting resources for compatibility, setup, travel-data and account-safety advice.