Can someone steal my number if I only use an eSIM?

Yes, through a remote port-out or SIM swap request to your carrier, not by physically removing a card. An eSIM prevents the physical theft scenario but doesn't block a social-engineering attack where someone convinces your carrier's support team to transfer your number to a new device.

Does switching to eSIM mean I can drop two-factor authentication apps?

No. eSIM only addresses the physical-card risk; it does nothing to stop someone from porting your number through your carrier's support channel. Keep using an authenticator app or hardware key for your important accounts regardless of which SIM format you use.

Is it harder for a thief to reuse a stolen eSIM profile than a stolen physical SIM?

Generally yes, because an eSIM profile is tied to a specific device's embedded chip and typically requires carrier-side reactivation to move, whereas a physical SIM can simply be popped into any compatible phone. That said, a carrier still has to approve any transfer in both cases, so the account-verification step remains the deciding factor.

Is an eSIM Safer Than a Physical SIM Card? What the Numbers Show

eSIMs can't be physically swapped like plastic SIMs, but the real fraud risk lives elsewhere. Here's where eSIM security actually helps.

SIM swapping isn’t a rare scam story anymore: the FBI’s Internet Crime Complaint Center 2023 Annual Report logged complaints with losses exceeding $48 million in a single year. At the same time, carriers are pushing eSIM adoption hard, and GSMA projects that eSIM-capable connections will reach 50% of total smartphone connections by 2025. So the question that actually matters isn’t whether eSIM is trendy — it’s whether switching protects you from the fraud that drained $48 million from victims last year. The honest answer is more nuanced than a marketing slide, and it depends almost entirely on where the real weak point sits in the chain between you and your carrier.

How a SIM actually gets hijacked

A plastic SIM can be physically removed from a phone and inserted into another device in seconds, but that’s rarely how modern fraud works. Most SIM swap attacks don’t touch the card at all: a scammer gathers your name, phone number, and a few personal details — often from a data breach or social media — then calls or messages your carrier’s support line pretending to be you. They request a ‘new SIM’ or a number port to a device they control. If the agent is convinced, your number moves instantly, and every SMS-based login code, bank alert, and two-factor code now lands in the attacker’s hands instead of yours. The physical card itself is almost incidental; the real weak point is the carrier’s identity-verification process. An eSIM changes the mechanics slightly, since there’s no card to physically issue, but the underlying vulnerability — a support agent approving a transfer based on weak identity checks — remains exactly the same unless the carrier tightens that process too. Think of the SIM, physical or embedded, as a key to a lock. If someone can convince the locksmith to cut a new key without checking your ID properly, it doesn’t matter whether the original key was made of metal or stored digitally — the locksmith’s judgment is the actual security boundary. Carriers know this, which is why the better ones now offer additional verification layers on top of whatever SIM format you use, rather than treating the hardware itself as the safeguard. Understanding this distinction matters because a lot of marketing around eSIM security quietly implies that the format alone solves the fraud problem, when in reality it only removes one narrow attack vector out of several.

A number ported before dinner

The following is an illustrative scenario, not a documented case tied to a real person.

Picture someone finishing a normal workday when their phone suddenly loses signal. No bars, no explanation. Thinking it’s a network glitch, they shrug it off until a friend mentions they just got a text from that same number saying hello from an unfamiliar account. By the time they reach their carrier, the number has already been transferred, and two banking apps have sent one-time codes to a device that was never theirs. The carrier later admits the transfer request included just enough personal information — found in a prior data leak — to pass the verification script on the phone. Nothing about the SIM format mattered here; the chain of trust that let the transfer go through is what failed, and that same chain exists whether the subscriber identity module is plastic or embedded in software. In the hours that follow, the real damage compounds quietly: password-reset emails get intercepted, a cloud backup gets accessed, and a second bank account gets flagged for a large transfer attempt before anyone outside the victim’s immediate circle even realizes something is wrong. None of that depended on anyone touching a physical card. It depended on a few minutes of convincing a stranger on a help desk, which is exactly why switching to eSIM alone would not have changed the outcome in this scenario — the attacker never needed to physically remove or insert anything.

Reducing the swap risk, step by step

eSIM technology removes one specific attack — physically stealing or swapping a card from your device — but it does nothing by itself to stop account-takeover attempts routed through carrier support. Real protection comes from combining the harder-to-clone format with account-level defenses that don’t depend on SMS at all.

Add a carrier PIN or port-out lock

Call your carrier and ask specifically for a port freeze, number-transfer PIN, or account lock on changes. This is the single most effective step against social-engineered swaps, because it forces anyone requesting a transfer — including a support rep being tricked — to produce a code you set, not just your name and birthdate. Most major carriers offer this for free, but almost none enable it by default, so you have to ask. Write the PIN down somewhere other than your phone, since the whole point is that it should survive even if your device is already compromised.

Move two-factor codes off SMS

Shift your most sensitive accounts — email, banking, cloud storage — to an authenticator app or a hardware security key instead of text-message codes. SMS-based 2FA is exactly what attackers are after when they port your number; once your authentication no longer depends on receiving a text, a successful SIM swap becomes far less useful to them. Start with the accounts that could cascade into others if compromised, like your primary email, since that’s usually the master key to resetting everything else.

Watch for the first signs of a swap

A sudden, unexplained loss of signal, especially paired with unexpected ‘your SIM has been updated’ texts, is an early warning, not a glitch to ignore. Call your carrier immediately through a number saved elsewhere (not from memory on the dead phone) and ask them to check for recent SIM or eSIM profile changes on your line. The first fifteen minutes after a swap are usually the window where damage is still containable, so treat a dead signal with more urgency than it feels like it deserves.

Separate your identity from your number where you can

For accounts and services that don’t need your real phone number, use a secondary number or an eSIM data-only plan not tied to your primary identity. This limits how much damage a single compromised number can do, since fewer services are chained to it. It also means that if one number is ever ported out from under you, the blast radius stops at whatever that specific line was used for, rather than spreading to your banking and email accounts in one move.

Where an eSIM-based plan actually helps

An eSIM-based travel or secondary data plan doesn’t replace the account-security habits above, but it closes the one gap that’s purely physical: there’s no card to pull out of your phone, hand to a stranger, or lose along with a wallet. For a secondary line you use for app verifications, travel connectivity, or separating personal and professional numbers, provisioning that line digitally through a service like Saily removes the risk of a swapped-out physical card entirely, since the profile lives in the device’s embedded chip rather than on removable hardware. It also sidesteps a specific low-tech trick: cloning or reactivating an old discarded SIM, which isn’t possible with an eSIM profile tied to your device. None of this replaces a port-out PIN or app-based 2FA, but as one layer among several, keeping a secondary number on an eSIM plan removes a physical attack surface that a plastic card simply can’t avoid. It’s a small, concrete improvement rather than a complete fix, which is the honest framing most providers skip when they advertise eSIMs as inherently more secure.

Phone