eSIM Scams: Fake QR Codes, SIM-Swap Tricks and How to Stay Safe

eSIMs are convenient and secure, but scammers have found ways to exploit them. Some use fake QR codes to steal personal details or money. Others trick people into moving their phone number onto an eSIM the scammer controls, so they can intercept bank security codes. This guide explains the most common tricks, how a genuine travel eSIM reaches you and what to do if something goes wrong.

Fake QR codes, or "quishing"

"Quishing" is phishing that uses a QR code instead of a link. Because you cannot read a QR code by eye, it is easy to hide a fake website behind one. Scammers use them in a few common ways:

• Stickers in public places: a fake QR code stuck over a genuine one on a parking meter, station poster or restaurant table, leading to a fake payment page.
• Texts and emails: a message claiming your eSIM needs "reactivating", your parcel is waiting or your account is locked, with a QR code to scan.
• Fake travel offers: a QR code promising free data or a discounted eSIM, which actually collects your card details.

How to spot a fake QR code

• Before you open a link from a QR code, look at the web address your phone shows. If it is misspelt or does not match the company, do not open it.
• Be wary of stickers that look like they have been placed over another code.
• Do not scan QR codes from unexpected texts or emails. Go to the company's website or app directly instead.
• Never enter card details or passwords on a page you reached from a QR code you were not expecting.

Fake cheap eSIM shops

Some websites and social media adverts offer travel eSIMs at prices that look too good to be true. Some take payment and never deliver. Others deliver an eSIM that does not work or has far less data than promised.

• Check that the seller has clear contact details, a support page and terms you can read before you pay.
• Be cautious of sellers who only take payment by bank transfer, cryptocurrency or gift cards.
• Look for clear details of the network, data allowance and validity for each plan.
• Buy through the seller's own website or official app, not through a link in a direct message.

SIM-swap fraud: when someone steals your number

SIM-swap fraud is more serious than a fake shop, because it targets your phone number itself. If a criminal moves your number onto a SIM or eSIM they control, they receive your calls and texts, including one-time passcodes from your bank.

How the scam usually works

• You receive a call, text or email that appears to come from your mobile network, offering a "network upgrade", a 5G switch or a free eSIM conversion.
• The caller asks you to read out a code that has just been texted to you, or to scan a QR code they send.
• That code or QR code is actually the authorisation to move your number to their eSIM.
• Your phone suddenly loses signal, and the criminal starts resetting passwords and accessing accounts.

Your network will never ask you to read out a security code to someone who called you. If you are not sure whether a call is genuine, hang up and call your network on the number printed on its website or your bill.

Keep your genuine eSIM QR code private

A genuine eSIM QR code, or the activation code that comes with it, works like a key. Anyone who has it may be able to install that eSIM on their own phone before you do, using the data you paid for.

• Only use an eSIM QR code that comes directly from your provider's own email, app or account.
• Never post a screenshot of your QR code on social media or in forums, even when asking for help.
• Do not forward it to anyone who contacts you claiming to be from support.
• If you think someone else has seen your code before you installed it, contact your provider straight away.

How a SimplySIM eSIM reaches you

When you buy a SimplySIM eSIM, the installation details only come from us, through channels linked to your own order and account:

• By email: after payment is confirmed, we email your eSIM QR code and installation instructions to the address you used at checkout. The email also includes the details for manual installation if you cannot scan the code.
• In your account: your eSIM details are also shown in your SimplySIM dashboard when you log in, where you can also check usage and buy top-ups.
• In the app: with the SimplySIM iPhone app you can install your eSIM in one tap, without scanning a QR code. A SimplySIM app is also available for Android.

We will not cold call you to "upgrade" your eSIM, and we will not ask you to send your QR code or activation code to anyone. If you are unsure whether a message is from us, log in to your account directly or use the contact page. You can read more about the setup process on our how it works page.

What to do if you suddenly lose service

If your phone shows "No service" or "SOS only" in an area where it normally works, and restarting does not fix it, act quickly. It could be a fault, but it could also be a SIM swap.

1. Use another phone or Wi-Fi calling on a different device to call your mobile network on its official number. Ask whether your number has been moved to a new SIM or eSIM.
2. Contact your bank using the number on the back of your card, and tell them you may be a victim of SIM-swap fraud.
3. Change the passwords for your email and main accounts from a trusted device, starting with your email.
4. Report fraud to Action Fraud, the UK's national reporting centre for fraud and cybercrime, if money or accounts have been affected.

If you are abroad and only your travel eSIM has stopped working, the cause is more likely to be coverage, settings or used-up data. Our eSIM no-data checklist covers the usual fixes.

Quick eSIM safety checklist

• Only buy eSIMs from a seller's own website or official app.
• Only install an eSIM from a QR code sent by your provider's own email, app or account.
• Never share your eSIM QR code or activation code.
• Never read out a security code to someone who called you.
• Check the web address before opening any link from a QR code.
• Use an authenticator app instead of text codes where your bank or email allows it.
• Set a PIN on your physical SIM, and ask your network about extra account security.
• If you lose service unexpectedly, call your network and your bank from another phone.

Frequently asked questions

Can someone steal my eSIM?

An eSIM cannot be pulled out of your phone, which makes it harder to steal than a physical SIM. The risk is that someone tricks you or your network into moving your number onto another eSIM, or uses an eSIM QR code you shared.

Is it safe to scan an eSIM QR code?

Yes, if it comes from your provider's own email, app or account. Do not scan eSIM QR codes sent to you by someone who contacted you unexpectedly.

Would my network call me to offer a free eSIM upgrade?

Be very cautious. If you get a call like this, hang up and contact your network directly using the number on its website or your bill.

Does a travel eSIM put my UK number at risk?

No. A travel data eSIM is a separate plan and does not move your UK number. Your UK SIM stays in your phone and keeps working as normal.

What should I do if I shared my eSIM QR code by mistake?

Contact your eSIM provider straight away with your order details. If the eSIM has not been installed yet, they may be able to help before anyone else uses it.