Every eSIM pitch starts with ease. No store visit, no plastic tray, no waiting for a card to arrive — scan a code, and you're online in a country you landed in twenty minutes ago.
That ease is real. But a 2025 USENIX Security study out of Northeastern University spent months testing roughly two dozen commercial travel eSIMs, built a private LTE testbed, and wired up a programmable eUICC to eavesdrop on conversations between a phone and its SIM profile. What they documented isn't a flaw in the eSIM spec. It's something harder to fix: the convenience that makes eSIM attractive also removes the friction that used to tell users something was happening.
The Part Nobody Puts in the Ad
What the Researchers Actually Did
The team bought travel eSIMs from providers listed on Apple's own support pages, installed them on a Pixel 4 XL and an iPhone 13, and traced where the data went. They also signed up as eSIM resellers on two wholesale platforms to see what a reseller dashboard exposes. Then they used a Sysmocom programmable eUICC with SIMtrace2 hardware to watch the raw channel between phone and profile.
Three months of measurements, all conducted from the United States. The results are worth reading whether you sell connectivity or simply buy it for a trip.
Your Traffic Doesn't Stay Where You're Standing
The Holafly Example
Install a travel eSIM from Holafly — an Irish-headquartered company — and the public IP address assigned to your phone can belong to China Mobile. Turn off GPS, and IP geolocation places the device in China. The provisioning server address used during installation (rsp1.cmlink.com) belongs to the same network.
Nothing about this is hidden in the fine print so much as absent from the marketing. Across the tested providers, IP addresses resolved to Texas, Poland, Denmark, Norway, Singapore, the Isle of Man — almost never to the user's actual country.
What That Breaks
Region-locked content stops behaving as expected: the researchers streamed a Hong Kong platform from the US with no VPN, purely because the IP said Hong Kong. But the same mechanism works in reverse for services that block traffic from certain jurisdictions, and it means your browsing metadata is visible to a network operator in a country you never chose.
"Home-Routed Roaming" Is the Mechanism Behind It
Where the Traffic Actually Goes
Most travel eSIMs run on home-routed roaming. Your data and signaling leave the visited network and tunnel back to the provider's home network before reaching the internet. The home network's packet gateway assigns your IP and processes every session, which gives it a complete view of which services you use and when, plus a rough idea of where you are from the mobility signaling.
Local breakout — routing straight out of the visited network — would reduce that visibility and cut latency. It's rare among travel eSIMs because it requires dedicated agreements with local carriers, which white-label providers rarely have.
Local Breakout Doesn't Solve It Either
Worth being precise: local breakout doesn't eliminate the privacy risk, it relocates it. The visited network and its intermediaries inherit the visibility instead, and their regulatory posture may be even less clear. The trust boundary moves; it doesn't disappear.
Becoming an eSIM Reseller Takes About Ten Minutes
What the Dashboard Shows
The study signed up with two wholesale platforms using nothing but an email address and a payment method, then "sold" profiles to their own test devices. The reseller dashboard exposed the IMSI, MSISDN, and eSIM PIN of active profiles. It also allowed sending SMS directly to end users, suspending or revoking profiles, and — on one platform — viewing device location estimated from cell tower data, accurate in some tests to within half a mile.
The same platform could assign a static public IP to a device. The researchers enabled it on an iPhone, confirmed it answered pings from anywhere, and then ran a small web server on the phone that anyone on the internet could browse.
Silent Traffic You Never Approved
The hardware setup caught profiles talking on their own. One provider's eSIM opened a session to a Singapore-registered address with no user action. Another silently retrieved an SMS originating from a Hong Kong number. Neither event surfaces in any UI a customer would think to check.
Deleting a Profile Is Uglier Than It Should Be
The Offline Deletion Trap
Delete an eSIM while the device has no internet connection, and the notification may never reach the provisioning server. The server keeps the profile marked active, and any attempt to reinstall it with the same QR code fails with an "already installed" error. In the study's case with a commercial US provider, the only fix was issuing a brand-new profile.
For a traveler who wiped the eSIM before boarding and now can't restore it, that's a support ticket at the worst possible moment. For an operations team managing hundreds of devices, it's a stuck device and a manual intervention.
One-Shot Installs and Locked Profiles
Several providers warn explicitly that their eSIMs install once and cannot be reinstalled after removal. Others bind the profile to a device's unique eUICC identifier, so it can't move. Some profiles carry policy rules that block deletion or deactivation — legitimate in enterprise device management, less comfortable when the entity enforcing it is an unregulated reseller.
A QR Code Is Now an Attack Surface
The Free Wi-Fi That Isn't
Picture a conference, airport, or hospital lobby offering "free connectivity" via a posted QR code. Scan it, and you've installed a third-party eSIM profile. That network operator can then shape your connectivity, observe your location, intercept traffic, weaken the security settings negotiated between device and network, and push binary SMS that alters device configuration.
With a physical SIM, none of this is reachable without someone handing you a card. With eSIM, distribution is a poster on a wall.
The Protocol Itself Holds Up. The Humans Don't.
Where RSP Is Actually Solid
The researchers attempted a man-in-the-middle attack against the provisioning download using a TLS interception proxy. It failed — the device rejected the proxy certificate, and the download aborted. Between honest participants, remote SIM provisioning does what it claims.
Where It Falls Apart
The weak point is identity verification. In the study's interaction with a major US carrier's support channel, basic account details appeared sufficient to request a profile transfer. That's the classic SIM-swap recipe, now executable remotely: impersonate the subscriber, convince support, take the number. Documented cases exist of attackers gaining phone-number control this way and walking straight into linked bank accounts. European operators are generally stricter, some requiring in-country presence to activate — a contrast worth noting when comparing markets.
What to Do About It
If You're Buying Connectivity
Check what your eSIM is actually doing. Turn off GPS, look up your assigned IP, and see which country it resolves to. Review the installed profile list on your device periodically rather than assuming it's clean. Keep the device online when deleting a profile, and confirm the deletion registered before you rely on reinstalling. Prefer providers that publish routing details and offer multi-factor authentication on account changes.
If You're Selling or Integrating It
Anyone building eSIM into a hotel guest program, an event, or a device fleet inherits these obligations. Disclose who controls the data and where traffic routes. Make deletion verifiable instead of best-effort. Don't hand out public static IPs by default. Vet the wholesale platform behind your white-label brand — your customers will assume it's you, and legally and reputationally, it may as well be.
Building an eSIM-based access or connectivity program and want it done without the privacy surprises? Talk to us about card and credential hardware that keeps control where it belongs — on your side of the deployment.
