eSIM Scams in 2026: The Numbers, the Two Different Threats, and the 60-Second Check
You are flying tomorrow, a listing promises unlimited data for a few dollars, and payment goes through fine. Here is what the FBI and FTC actually record, why the scariest eSIM story does not apply to travel data plans, and the check that takes a minute.
Quick answer: Written for the traveller buying an eSIM from a link the night before a flight. Two threats get blurred together and they are not the same. A travel data eSIM has no phone number, so it cannot be used to steal your SMS codes: the SIM swap risk sits on your home carrier account. The travel risk is commercial, a seller who takes payment and delivers a dead QR code. The FBI's IC3 recorded 971 SIM swap complaints and US$17,366,758 of reported losses in 2025.
Key takeaways
- Two different threats, often confused. SIM swap attacks your home number to steal codes. Fake eSIM sellers attack your wallet and your trip. Different defences, and only one of them involves the eSIM you are about to buy.
- The FBI's numbers, dated. The IC3 2025 Annual Report lists SIM Swap as its own crime type: 971 complaints and US$17,366,758 in reported losses in 2025, against 982 complaints and US$25,983,946 in 2024 and 1,075 complaints and US$48,798,103 in 2023. Average reported loss per complaint fell from about US$45,400 in 2023 to about US$17,900 in 2025.
- The tell is silence. The FTC's sign of a SIM swap is your cell phone suddenly stops working: no data, no text messages, no phone calls, or a notification that your SIM card has been activated on a new device.
- Your carrier now has legal duties in the US. The FCC adopted rules on 15 November 2023 requiring wireless providers to securely authenticate a customer before redirecting a number to a new device or provider, and to notify customers immediately whenever a SIM change or port-out request is made.
It is the night before the flight. The connection question got left to last, a listing appears with a price that looks generous, payment goes through smoothly, and a QR code arrives by message. Sometimes it works. Sometimes it installs and never connects, and the seller's account is gone by the time you land. The people this happens to are not careless, they are late, and late is the condition every one of these scams is designed for.
What are the real numbers on SIM swap and eSIM fraud?
The FBI's Internet Crime Complaint Center tracks SIM Swap as its own crime type. These are complaints filed with IC3, so they undercount the real total and cover the United States only, but they are the most solid public figures there are.
| Year | SIM swap complaints to IC3 | Reported losses | Average per complaint |
|---|---|---|---|
| 2023 | 1,075 | US$48,798,103 | About US$45,400 |
| 2024 | 982 | US$25,983,946 | About US$26,500 |
| 2025 | 971 | US$17,366,758 | About US$17,900 |
For scale, IC3 recorded 1,008,597 complaints and US$20.877 billion in losses across all crime types in 2025. SIM swap is a small share of that by volume and a large share of it by damage per victim, which is exactly the shape of an attack aimed at accounts rather than at pocket money. The downward trend in reported losses is real but it is a trend in reports, not proof that the attack got rarer.
Does a travel eSIM put my bank accounts at risk?
| SIM swap | Fake or dead travel eSIM | |
|---|---|---|
| What the attacker wants | Your phone number, to receive your codes | Your payment, or a malicious link click |
| Where it happens | At your home carrier, by impersonating you | At a seller you found in a listing, a DM or an ad |
| Does a travel data eSIM matter | No. It is data only and carries no phone number, so there is nothing to swap | Yes. This is the transaction being attacked |
| First sign | Your own phone goes silent: no data, no texts, no calls | The QR does not install, or installs and never connects, and support goes quiet |
| What protects you | An authenticator app instead of SMS, a PIN on the carrier account, limiting what you share online | Buying where there is a company, a published policy and a support channel |
| Who else is involved | Your carrier, which in the US must now authenticate and notify | Your payment provider, for a dispute |
How do I tell a real eSIM seller from a fake one in 60 seconds?
- No named company or jurisdiction. A legitimate seller shows a legal entity somewhere on the site. A brandless checkout page with a messaging handle is not a company.
- The price fails the sanity check. See the benchmark below. Wholesale mobile data has a real cost and nobody gives it away.
- Payment only by gift card, bank transfer to a personal name, or a raw crypto address with no alternative. Real merchants offer card processing alongside anything else.
- No refund or replacement policy you can read before paying. eSIMs occasionally fail. Honest sellers publish what happens next.
- The QR code arrives by direct message. Forwarded and recycled QR codes carry no warranty and no support. Buy in an app or on the provider's own site.
- A fresh domain and reviews that look assembled. Search the company name plus the word scam before you pay, not after.
- A QR code you did not request. The FTC's September 2026 advice on QR codes is to inspect the link first, since many QR readers preview the destination, and to look for spelling mistakes or switched letters in the URL.
What should a travel eSIM actually cost? A price sanity check
| Real plan, 23 September 2026 | Carrier | Total | Per day | Per GB |
|---|---|---|---|---|
| Thailand, 10 GB, 7 days | TrueMove H, 4G and 5G | US$12.87 | US$1.84 | US$1.29 |
| Japan, 10 GB, 7 days | KDDI, 4G and 5G | US$17.18 | US$2.45 | US$1.72 |
| South Korea, 5 GB, 30 days | LG U+, 4G and 5G | US$10.12 | US$0.34 | US$2.02 |
| South-Eastern Asia, 10 GB, 7 days, 18 countries | By country, 5G or 4G | US$23.52 | US$3.36 | US$2.35 |
| Thailand, unlimited, 7 days | TrueMove H, up to 10 Mbps | US$21.95 | US$3.14 | not applicable |
| Japan, unlimited, 30 days | KDDI, up to 10 Mbps | US$70.94 | US$2.36 | not applicable |
| Taiwan, unlimited, 3 days | Taiwan Mobile, no cap stated | US$16.08 | US$5.36 | not applicable |
| 1 GB, 3 days, 18 countries | By country, 5G or 4G | US$9.94 | US$3.31 | US$9.94 |
What is your carrier obliged to do?
More than most people realise, at least in the United States. On 15 November 2023 the FCC adopted a Report and Order revising its Customer Proprietary Network Information and local number portability rules. In the Commission's own words, the rules require wireless providers to adopt secure methods of authenticating a customer before redirecting a customer's phone number to a new device or provider, and to immediately notify customers whenever a SIM change or port-out request is made on their accounts.
Two practical consequences. First, a notification about a SIM change you did not request is not spam, it is the alarm, and it deserves a phone call to your carrier within minutes. Second, you can ask your carrier today to put a port-out PIN or account passcode on the line, which is the single highest-value thing on this page and takes about five minutes.
Terms and conditions
- Information only. Fizen publishes this article to inform, not to sell. Nothing here is an offer, solicitation or sale of any product or service, and it is not financial, investment, legal or tax advice. It is not security advice for any specific situation either.
- For readers in the United States. This article provides information only. It is not an offer, solicitation or sale of any product or service, and it is not financial, investment, legal or tax advice. Fizen is not offered to US Persons.
- Not affiliated. Fizen is not affiliated with, endorsed by or a partner of the FBI, the Federal Trade Commission, the Federal Communications Commission, KDDI, LG U+, TrueMove H or any other third party named here. Citing a public agency is not an endorsement by that agency.
- Figures and rules change. Crime figures are as published in the FBI IC3 2025 Annual Report and count complaints filed with IC3 in the United States, so they undercount the real total. FCC and FTC guidance applies in the United States and equivalent rules differ elsewhere. Plan prices are those shown in the Fizen catalogue on 23 September 2026 and change without notice.
- No method is complete protection. The checks here reduce risk, they do not remove it. If you believe your number or your accounts have been compromised, contact your carrier and your bank first, and report it to your national fraud body.
- Data only. A travel eSIM provides mobile data. It does not give you a local phone number, voice calls or SMS. Keep your home SIM active for bank codes. Your phone must support eSIM and must not be locked to a carrier.
- Full terms. Master Terms of Use, Privacy Policy and Disclaimer on the Fizen site.
Sources
- FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (SIM Swap figures)
- FTC Consumer Advice: SIM swap scams, how to protect yourself
- FTC Consumer Advice, 3 September 2026: see a QR code parked somewhere, do not scan it yet
- FCC news release, 15 November 2023: FCC adopts rules to protect consumers' cell phone accounts
- FCC: announcement of the effective compliance date for the SIM swapping item
- Fizen eSIM FAQ: data only, one device per eSIM, returns and troubleshooting
- Apple Support: use eSIM while traveling internationally with your iPhone
Updated 23 September 2026.
City guides: Bangkok eSIM guide.
