eSIM vs physical SIM: Security differences, risks, and how fraudsters exploit them

In a concerning trend, a 47-year-old man from Bengaluru lost over ₹11.9 lakh after falling victim to fraudsters during a deceptive eSIM activation scheme. Similarly, an IT engineer from Noida suffered a loss exceeding ₹24.8 lakh after a scammer, impersonating a telecom executive, convinced her to switch from a 4G SIM to 5G. These incidents highlight a broader issue of SIM-related fraud, as another 27-year-old individual from Bengaluru also lost ₹7 lakh in a SIM-swap scam. Alarmingly, this victim did not receive any suspicious calls, raising questions about the methods employed by these criminals. Currently, India boasts over a billion smartphone users, and whether utilizing a traditional SIM card or a digital eSIM, these elements are crucial for identity verification. Mobile numbers serve as gateways for various services, including banking and social media, which rely on them for OTPs and security alerts. If fraudsters gain access to your SIM card, they can intercept OTPs, reset passwords, and breach sensitive accounts. Understanding the key differences between physical SIMs and eSIMs is vital in recognizing how criminals may exploit each type. An eSIM, or embedded SIM, is integrated directly into a phone's motherboard, eliminating the need for a physical card. Activation involves scanning a QR code or entering a code provided by the carrier. While this design offers a layer of security against theft, it is not entirely foolproof, given that attackers must gain access to both the unlocked device and the necessary credentials for an eSIM transfer. In contrast, a physical SIM card is a small plastic module that connects to mobile networks, storing vital identification information. It enables services such as calling, texting, internet access, and video streaming when inserted into smartphones. Despite the perception that eSIMs are more secure, criminals have devised clever tactics to exploit this technology. Common scams include impersonating telecom executives to offer fraudulent 5G upgrades without proper verification, leading to immediate network disconnection and subsequent financial theft. Additionally, fraudsters may pose as bank officials, convincing victims that their eSIM needs to be converted to a physical SIM for security reasons. Another significant scam involves individuals impersonating the Telecom Regulatory Authority of India (TRAI), claiming that a SIM card will be deactivated due to fraud or KYC issues. These scammers create a sense of urgency, pushing victims to divulge sensitive information such as Aadhaar numbers, OTPs, and banking details. As the landscape of mobile technology evolves, staying informed and vigilant against such scams is essential for safeguarding personal information and finances.