Are eSIMs safe? Can an eSIM be hacked, cloned or tracked?
Yes, eSIMs are safe: they rely on the same encryption and security standards as the physical SIM cards phones have used for decades. An eSIM is a chip built into your device, so it cannot be physically removed or swapped, and cloning it would require deep access to protected hardware. Like any connected service, sensible habits still matter, so it helps to know what an eSIM does and does not expose.
Can an eSIM be hacked or cloned?
An eSIM stores its identity in a tamper-resistant secure element inside your device. Cloning a physical SIM historically meant copying its data onto another card; an eSIM's credentials are locked inside the embedded chip and protected by the same cryptographic keys carriers use, which makes copying it extremely difficult. The more common real-world risk is not the eSIM itself but account-level attacks like SIM swapping, where someone tricks a carrier's support team into moving your number, which is a social-engineering problem rather than an eSIM flaw. A travel data eSIM is data-only and not tied to your personal phone number, which further limits that exposure.
Can an eSIM track my location?
An eSIM does not track you any more than a normal SIM would. Any device connected to a mobile network can be located approximately by which towers it uses, and that is a property of all cellular connectivity, not something unique to eSIM. The eSIM profile itself adds no tracking, contains no spyware, and cannot reach your photos, messages or apps; it only provides the network connection. A travel data eSIM simply carries your internet traffic, the same way roaming would.
How to keep your eSIM secure
- Keep a screen lock (PIN, fingerprint or face) on your device, since your eSIM lives inside it.
- Install eSIM profiles only from the QR code or link sent by your provider, and never share that QR code with anyone.
- Use a VPN on public Wi-Fi when handling sensitive accounts, because the eSIM secures the mobile link, not every app you open.
- Add extra protection (an authenticator app or PIN) to your bank and email accounts to blunt any SIM-swap attempt on your main number.
- If your phone is lost or stolen, contact your provider so the eSIM profile can be removed remotely.