Travel eSIMs offer convenient mobile connectivity abroad, but experts warn of rising cyber threats, including phishing, eSIM swapping and identity theft. Learn how to protect your phone number and personal data
KUALA LUMPUR: Travellers now have a range of options for mobile connectivity abroad, from roaming services and buying a SIM card at their destination to using a travel eSIM, which can be obtained digitally.
In line with advancing technology, travel eSIMs are gaining traction as they allow users to activate mobile services digitally on compatible devices without the need for a physical SIM card.
More appealing still, some devices can store more than one eSIM, making it easier for users to manage and use different mobile plans according to their travel needs.
As travel eSIMs, bought and activated online via a QR code, grow in popularity, users must also be wary of criminals exploiting the method by posing as eSIM providers or using fake websites and QR codes to trick them into making payments or revealing personal information.
Senior researcher at the Centre for Cyber Security and Data Intelligence (CCDI), Universiti Tun Hussein Onn Malaysia (UTHM), Assoc Prof Dr Zubaile Abdullah, said that while eSIMs offer the convenience of managing profiles virtually, they have now become a prime target for phishing and social engineering activities.
“Users need not fear using eSIMs, but they must understand that a phone number is now part of a highly sensitive digital identity. It must be safeguarded as carefully as a banking password,” he told Bernama recently.
He explained that while the technology has standard security mechanisms set by the Global System for Mobile Communications (GSMA), weaknesses often arise at the level of user access control.
Expanding on this, Zubaile said the most significant risk is cybercriminals exploiting digital processes to bypass the security controls of telecommunications companies.
He said that because the activation, transfer, or replacement of an eSIM can now be carried out entirely online without any physical presence, customers’ telco accounts have become a prime target.
“If criminals succeed in taking over an account through phishing, they can abuse the eSIM replacement process to transfer the victim’s phone number to their own device.
“An eSIM does not directly expose a device to malware, but it changes the risk landscape, demanding serious attention to identity verification and digital account security,” he explained.
He said a phone number is the ‘key’ to various critical accounts, including banking through one-time passwords (OTPs) and official communication apps such as WhatsApp.
Zubaile also cautioned users never to give an OTP or verification details to anyone, even if the individual claims to be a representative of a telecommunications company.
“If your phone suddenly loses signal for no apparent reason, do not dismiss it as a routine coverage issue. Check with your telco immediately, as it could be a sign that your account is being compromised or that your eSIM is being transferred without authorisation,” he said.
Meanwhile, Senior Lecturer at the Faculty of Computer and Mathematical Sciences, Universiti Teknologi MARA (UiTM), Dr Mohsen Mohamad Hata, said eSIMs offer conveniences such as faster network switching, as well as better physical durability compared with regular SIM cards.
“An eSIM is an embedded software SIM that enables telecommunications profiles to be managed digitally. It optimises a device’s hardware space and is supported by the Malaysian Communications and Multimedia Commission (MCMC) through Electronic Know Your Customer (eKYC) digital identity verification,” he said.
However, he said the convenience also comes with cybersecurity challenges, such as ‘eSIM swapping’, interception of unprotected activation QR codes, and phishing attacks targeting telecommunications providers’ portals.
He said criminals who obtain telco account login credentials through phishing can apply for a new eSIM profile online to intercept banking or other OTP codes belonging to the victim.
“The use of malware such as ‘keyloggers’ also risks the theft of login information or accessing activation QR codes stored in a user’s device gallery,” he said.
As a preventive measure, he advised users to enable app-based two-factor authentication (2FA), set a strong device PIN, and refrain from sharing eSIM activation QR codes with any third party.