Are travel eSIMs safe? Security, privacy and what the apps collect

The eSIM chip is the safest part of the whole arrangement. It cannot be removed from a stolen phone and dropped into another. It is provisioned over an encrypted channel between your phone and the seller's server, using the same standard every carrier uses. Cloning a profile off a phone is not a practical attack. If you are worried about the eSIM itself, you can stop.

The soft spots are around it. The seller's app and what it collects, your account with the seller and how well it is protected, the phishing email that looks like an activation message, and the hotel WiFi you connect to when the plan runs out. Those are worth ten minutes of attention, and this guide covers each.

The chip: what the standard gives you

An eSIM profile is downloaded from a provisioning server over TLS, signed by the operator, and stored in a secure element in the phone that the operating system cannot read directly. The profile cannot be exported. If the phone is stolen, the thief has the phone and the profile on it, but cannot move the profile anywhere else, and a remote wipe removes it. Compare that with a plastic SIM, which any thief can pull out in seconds and use in another handset to receive your SMS codes. On theft, the eSIM is strictly better.

The app: what it collects

This is where the real privacy question lives. To sell you a plan, a seller needs an email and a payment. To install the profile, the app needs to talk to the phone's eSIM manager. Beyond that, collection is a choice, and sellers choose differently.

Researchers at Northeastern University examined travel eSIM apps and found significant gaps in how personal data is handled across the ecosystem, including data flowing through jurisdictions with weaker protections and third party analytics receiving more than the service needs. That matches what we see reviewing seller apps: some request location, contacts or advertising identifiers that have nothing to do with delivering data abroad.

What to do about it:

• Deny location unless the app has a real reason. Selling you a plan does not need to know where you are.
• Deny contacts. No eSIM seller needs your address book.
• On iPhone, choose Ask App Not To Track. On Android, delete the advertising ID in Settings, Privacy.
• Buy on the website where you can. Many sellers let you purchase in a browser and install the profile from the emailed QR code, with no app at all.
• Use a payment method with its own protection: a card with virtual numbers, Apple Pay or Google Pay, or PayPal. The seller then never holds your card.

The account: the actual attack surface

If someone gets into your account with the seller, they can see your plans, reissue codes, and buy on your saved card. That is the realistic risk, and it is the same as any online account. Use a unique password, turn on two factor login if the seller offers it, and do not save the card if you will not reorder.

The related fraud is SIM swap, where a criminal persuades your home carrier to move your number to their SIM and then receives your bank codes. It has nothing to do with the travel eSIM, but travellers are a favourite target because they are away from home and slower to notice. Set a port out PIN or account PIN with your home carrier before you go. Most carriers offer one and few customers use it.

The email: phishing dressed as activation

An eSIM purchase produces an email with a QR code. That makes a fake activation email a convincing lure, and they circulate. Check the sender's domain matches the seller's website exactly. Install QR codes only from Settings, never from a link that opens a web page asking you to sign in first. A genuine code installs a profile; it never asks for a password.

The network: data versus WiFi

Mobile data over the eSIM is encrypted between the phone and the tower. Nobody in the cafe can read it. Public WiFi is the opposite: unencrypted networks let anyone nearby watch unencrypted traffic, and even on encrypted networks the operator sees every site you connect to. Nearly all traffic today is itself encrypted with HTTPS, so the content is protected either way, but the destinations are not. For most travellers this is why the eSIM is safer than the hotel WiFi, not less safe.

A VPN: when it adds something

A VPN encrypts everything from the phone to the VPN server, hiding your destinations from the network and the seller, and hiding your location from the sites you visit. Over the eSIM's mobile data it adds privacy rather than security, since the data is already encrypted to the tower. Over public WiFi it adds both. Three situations where it earns its place:

• You will use hotel, cafe and airport WiFi regularly.
• You are going somewhere that blocks services you rely on. Note that many travel eSIMs route through a home country, so in China, for example, blocked services often work over the eSIM with no VPN at all. Test before assuming.
• You would rather the network operator and the seller not see which sites you visit.

Install and log in to the VPN at home. Downloading one after arrival is difficult in countries that restrict them, and impossible without data.

The seller: how to judge one you have not heard of

The cheapest plan for a country is often from a seller most people have never heard of, and that is fine, provided a few things hold. A recognised payment processor at checkout. Published plan terms, including the daily cap on unlimited plans and the refund policy. A support channel with a real response. A privacy policy that says what is collected and where it goes. We record all of this on our provider pages, alongside price, and it feeds the ratings.

What we do not know

We can read a seller's privacy policy and inspect an app's permissions. We cannot see inside their servers or verify where data actually goes after collection. Nobody outside the company can. What we can do is note which sellers publish clear policies, request minimal permissions, and offer browser purchase with no app, and we do. The rest is the same judgement you apply to any online service, applied to one you will use for two weeks and then forget about.