eSIM Security and Privacy Guide 2026

SIM swap fraud is one of the most common forms of mobile-based identity theft. An attacker contacts a carrier's customer support, impersonates the account holder using personal information gathered from data breaches or social media, and convinces the representative to transfer the victim's phone number to a new SIM card under the attacker's control.

Once the number is transferred, the attacker receives all SMS messages sent to that number — including two-factor authentication codes for banking, email, and social media accounts. The attack has resulted in losses of millions of dollars for individual victims.

eSIM makes this attack harder in two ways. First, transferring an eSIM profile requires authenticated access to the carrier's online eSIM management system, not a phone call to a human representative who can be socially engineered. Second, most carriers require multi-factor authentication for eSIM transfers, meaning an attacker needs more than just personal information to succeed.

eSIM is not fully immune to SIM swap attacks — a determined attacker with access to carrier systems or your email account can still execute a transfer. But the bar is substantially higher than with a physical SIM, and the social engineering vector that makes physical SIM swap so easy is largely removed.

A cellular eSIM connection is significantly more secure than public WiFi for sensitive tasks. This is not a close comparison — the threat models are fundamentally different.

Public WiFi networks — in hotels, airports, cafes, and transit hubs — are shared with dozens or hundreds of unknown users. A sophisticated attacker on the same network can set up a rogue access point that mimics the legitimate network name, intercepting traffic from devices that connect automatically. Even on legitimate public networks, unencrypted DNS requests can reveal which sites you are visiting.

LTE and 5G cellular connections use mutual authentication between the device and the tower, encrypted radio channels, and carrier-grade security infrastructure. Intercepting cellular traffic requires specialized hardware (IMSI catchers) that costs tens of thousands of dollars and is primarily available to law enforcement. For the vast majority of travelers, cellular interception is not a realistic threat.

The practical rule is straightforward: use your eSIM cellular connection for banking apps, work logins, and any account with sensitive information. Connect to hotel or cafe WiFi for streaming and downloads where interception risk is lower and bandwidth consumption savings are real.

Saily is an eSIM provider built by Nord Security, the company behind NordVPN. Every Saily plan includes access to NordVPN servers at no additional cost. This integration is meaningful for security-conscious travelers.

When you activate NordVPN on a Saily connection, all traffic from your device is routed through an encrypted NordVPN server before reaching the open internet. This means your eSIM carrier sees only that data is going to a VPN server — not which websites you visit, which services you use, or what content you send or receive.

NordVPN operates under a strict no-logs policy, verified by independent audits from Deloitte and PricewaterhouseCoopers. This means that even NordVPN itself does not retain records of your browsing activity.

The practical benefit is significant for three groups of travelers:

• Journalists and researchers who need source protection and cannot risk traffic analysis revealing who they communicate with
• Remote workers accessing corporate networks and sensitive client data on foreign carrier infrastructure
• General travelers who want an additional layer of privacy without managing a separate VPN subscription

Saily's pricing reflects the added value. A 5GB Europe plan costs $12.99 — more than Nomad's $13 for 3GB, but comparable when you factor in NordVPN's standalone price of $3.69/month. For travelers who would buy a VPN subscription anyway, Saily is effectively an eSIM with a VPN included at no extra cost.