Can an eSIM be hacked or cloned? The honest security answer
Key takeaways
- Researchers have publicly demonstrated eSIM cloning. But the attack required physical access to the chip and publicly known keys.
- An eSIM cannot be skimmed or copied the way a physical SIM could be. There is no card to steal.
- The realistic threat to most people is SIM swapping. It tricks the carrier rather than the chip, and it works against eSIM users too.
An eSIM is a digital SIM card built directly into your device. Instead of a plastic card you slide into a tray, your carrier profile is downloaded as software onto a chip. The chip is called the eUICC, the embedded Universal Integrated Circuit Card. You can add, remove, and switch carrier plans from your phone's settings.
That design removes some attacks entirely and leaves others untouched. Marketing often claims eSIMs are unhackable, which is not true. A 2025 security disclosure proved that cloning is possible under lab conditions. Meanwhile, a far simpler fraud keeps working in the real world.
This article explains what an eSIM is, how researchers cloned one, why the demonstrated attack is hard to pull off, and which threat you should actually protect against.
Micro and nano SIM cards with their trays. Photograph: Tony Webster/Wikimedia Commons
Image Credits: Wikimedia Commons
What an eSIM actually is
Every SIM, physical or embedded, holds the same kind of secret: credentials that prove to the network you are who your phone number says you are. The industry name for the container is the eUICC. It can store multiple carrier profiles and switch between them remotely, over the air.
"The eUICC card makes it possible to install the so-called eSIM profiles into the target chip," Security Explorations said. "eSIM profiles are software representations of mobile subscriptions."
Because the chip is soldered into the device, nobody can pocket your SIM at a party or copy it with a cheap reader. The profile arrives encrypted from the carrier's provisioning server. That is a genuine security upgrade over a card you can lose.
Can an eSIM be cloned like a physical SIM card?
In theory, yes. But the bar is much higher than with old physical SIMs. Cloning means extracting the secret keys from one chip and copying the profile onto another. Then the attacker's device authenticates as you. Your calls, texts, and two-factor codes would route to them.
The first public demonstration of this against a consumer-grade eUICC came from Security Explorations. That is a research lab of AG Security Research. The researchers targeted eUICC cards from Kigen. Kigen is an Irish company whose secure SIM operating system has been used in more than two billion SIMs, per The Hacker News. The team managed to extract private ECC keys from the chip.
In a live demonstration, the team cloned an Orange Poland eSIM profile. The victim's communications were rerouted to the attacker's device without any visible sign on the original phone, The Daily Tech Feed reported. Kigen paid the researchers a $30,000 bounty for the responsible disclosure.
That sounds alarming, and it is a real finding. But the fine print matters enormously.
The Kigen eUICC vulnerability researchers demonstrated
The flaw lived in the GSMA TS.48 Generic Test Profile, versions 6.0 and earlier. This is a test profile used for radio compliance testing in eSIM products. It allowed the installation of non-verified, potentially malicious JavaCard applets on the chip. A revised specification, TS.48 v7.0, restricts the test profile and blocks that installation path. Older versions were deprecated.
Kigen's own assessment put the practical difficulty plainly. The company said successful exploitation requires specific conditions. It starts with physical access to the target chip and knowledge of publicly known keys. Without the device in hand, the attack does not get off the ground.
Infosecurity Magazine summarized the worst case: an attacker with physical access could extract device identity certificates and download profiles without authorization. That would jeopardize operator data and could intercept communications. Security Explorations also warned that the underlying Java Card VM weakness may have deeper architectural roots than one patched test profile.
So the honest summary is this: eSIM cloning is not a myth, but it is a lab-grade attack. It needs your device, specialized knowledge, and a specific vulnerable chip. No attacker is cloning your eSIM from across the internet.
A hand holding a smartphone with an embedded eSIM. Photograph: NeONBRAND/Wikimedia Commons
Image Credits: Wikimedia Commons
The realistic threat: SIM swapping, not cloning
The attack that actually drains accounts is older, simpler, and aimed at the carrier's support desk rather than your chip. In a SIM swap, a fraudster convinces your carrier that they are you. Then they get your number moved to a SIM they control. No hacking of the eUICC is involved at all.
Once the number moves, SMS-based two-factor codes follow it. The attacker can then reset passwords and walk into your accounts. "Because we so frequently use our phone numbers for two-factor authentication, a bad actor who takes control of a phone can also take control of financial accounts, social media accounts, the list goes on," FCC Commissioner Geoffrey Starks said when the commission moved against this fraud.
In November 2023 the FCC adopted rules requiring US wireless providers to authenticate customers securely before any SIM change or port-out. They must also notify customers immediately when one is requested, The Hacker News reported. The rules exist precisely because the weak point was never the chip. It was the process of moving a number between devices.
An eSIM does not protect you from a SIM swap. The carrier can reissue your number to a new eSIM on the attacker's phone just as easily as to a plastic SIM.
How to protect your eSIM
Start with the carrier's own locks. Most large carriers now offer a free SIM protection or number lock feature. It blocks SIM changes and port-outs until you switch it off from an authenticated session. It is usually off by default, so turn it on deliberately.
Move your important accounts off SMS-based two-factor authentication. Authenticator apps and hardware security keys do not travel with your phone number. A SIM swap leaves them untouched. This single change removes most of the payoff from the attack.
Treat eSIM transfer prompts with suspicion. If your carrier texts about an eSIM activation or transfer you did not start, treat it as an attack in progress. Call the carrier from another phone immediately. And keep your device's software updated: the Kigen case showed that the eSIM stack, like any software, gets patched. Updates are how those patches reach you.
The evolution of SIM card formats, from full-size to nano. Photograph: Bidouille82/Wikimedia Commons
Image Credits: Wikimedia Commons
Frequently asked questions
Can someone clone my eSIM remotely?
No. The demonstrated cloning attack requires physical access to the chip plus knowledge of specific keys, per Kigen's own assessment. There is no known way to copy an eSIM over the network.
Is an eSIM safer than a physical SIM?
Against theft and physical copying, yes. Nobody can remove or skim a chip soldered into your phone. Against SIM swapping, it offers no extra protection. That attack targets the carrier's account processes.
What was the Kigen eSIM vulnerability?
Researchers at Security Explorations found that Kigen's eUICC cards, used in billions of devices, allowed installation of unverified applets through an old GSMA test profile. They extracted private keys and demonstrated profile cloning. Kigen patched the issue and the GSMA revised the test profile specification.
Should I switch back to a physical SIM for security?
No. A physical SIM is easier to steal, lose, and copy with a reader. Keep the eSIM, enable your carrier's SIM lock, and move your two-factor authentication off SMS.
The bottom line
An eSIM can be hacked or cloned, but only under demanding lab conditions that start with holding your device. For everyday life, the chip is the strong part of the system. The weak part is the carrier process that moves your number. That is where SIM swapping still succeeds.
Protect the number, not just the chip: lock SIM changes at your carrier and get your two-factor codes off SMS. Those two steps do more for your security than any debate about SIM formats.
Topics: eSIM, mobile security, SIM swap, smartphones, cybersecurity
Rive News is the research desk behind the Rive News publication, covering technology and science through sourced, evergreen explainers.
Related stories
- How electric car batteries degrade over time: cycle and calendar aging explained
- APY vs interest rate: what compounding does to your money
- Why diamond is hard and graphite is soft when both are carbon
- eSIM for multi-country travel: how regional plans actually work
Get one sourced explainer like this in your inbox every morning. Subscribe to the Rive News newsletter.
© 2026 Rive News. All rights reserved.
Related stories
Apple plans two October launches: smart home hub, OLED MacBook Pro
Apple set October 13 for a smart home launch with a new hub, Apple TV 4K and HomePod mini, then October 27 for OLED MacBook Pro models
How to Check If Your Phone Supports eSIM in 30 Seconds
Dial *#06# and look for an EID number to confirm eSIM support in under 30 seconds. This guide also walks through the iPhone and Android
eSIM vs iSIM: what is the difference?
An eSIM is a dedicated chip on the phone's board, while an iSIM lives inside the processor itself. Qualcomm's Snapdragon 8 Gen