eSIM safety and privacy

Data-only, stated plainly

Airalo, Holafly, Saily, Nomad, Ubigi and Maya Mobile all sell data-only plans. There is no number attached, so nobody can call or text the eSIM and the eSIM cannot call or text anybody through the ordinary telephone network. It is a pipe to the internet and nothing else.

This is a deliberate design choice rather than a limitation providers are hiding. Voice roaming is a separate and more expensive wholesale arrangement, and stripping it out is most of the reason travel eSIMs are cheap. The reasoning is explained further in how eSIMs work.

What still works, and what does not

The right-hand column is the whole problem, and it is smaller than people fear. Nothing in it is caused by the eSIM. It is caused by leaving your home line switched off.

The dual SIM arrangement that solves most of it

On a dual SIM phone the answer is straightforward. Keep your home line switched on so it can receive calls and texts on your usual number, with data roaming turned off for that line so it cannot carry data or generate a bill. Set the travel eSIM as your data line. Your number keeps working for verification codes while all your internet traffic goes over the cheap plan.

Two details make or break this. On iPhone, turn off automatic mobile data switching, or the phone can fall back to the home line and quietly roam. And check your own carrier's terms for what receiving texts and calls abroad costs, because that varies and is not something a travel eSIM provider controls. The full settings walkthrough is in device compatibility.

If your phone has only one line available, you are choosing between your number and cheap data. In that case the pre-trip preparation below stops being optional.

Get off SMS codes before you leave

SMS is the weakest common form of two-factor authentication and also the most fragile one to travel with, since it depends on a network reaching your number in a foreign country. The NCSC's guidance on two-step verification notes that codes can arrive by several routes including authenticator apps, and that the important thing is having it switched on at all. For travellers, the route matters as well as the fact, because an app-based code works anywhere there is data.

• Move email, cloud storage and social accounts to an authenticator app or passkeys. Both work entirely over data.
• Download and store backup codes somewhere you can reach without a phone signal. This is the single highest-value ten minutes of trip preparation.
• Check each banking app individually. Many now approve payments in-app, which works fine on data. Some still send an SMS, and those are the ones that need your home line alive.
• Confirm your recovery methods do not all point at the same phone number, and add a second route while you are still at home.
• Tell your bank you are travelling, so that a login from an unexpected country does not trigger the exact SMS challenge you cannot answer.

Where the workarounds themselves fail

The obvious fallback for calls is a voice-over-internet app, and in most countries that works well. It is not universal. In the United Arab Emirates, standard voice-over-internet apps are restricted at network level, so planning to place calls through them is planning on something that may simply not connect. The same logic applies to app-dependent eSIM installs in countries that block them, which is covered in activation troubleshooting.

What eSIM changes about privacy, and what it does not

An eSIM profile is issued by a real mobile operator, and your traffic passes through that operator's network exactly as it would through a home carrier. The provisioning process itself is a standardised, cryptographically protected exchange between your phone's chip and the provider's server. There is no meaningful privacy difference between a plastic SIM and an embedded one.

What does change slightly is the counterparty. You are buying from a reseller rather than from your own carrier, and the reseller holds your purchase details and account. Ownership is worth knowing for that reason alone, and we list it on every provider: Saily belongs to Nord Security, Nomad to LotusFlare, Ubigi to Transatel and NTT, and Maya Mobile to Mobile Maya Inc.

There is one genuine security upgrade. A profile cannot be pulled out of a stolen phone and dropped into another handset the way a plastic SIM can, which removes one route to hijacking a number. The same property is the reason a travel profile normally cannot be moved to a replacement phone if yours breaks, so it cuts both ways.

Set up, then travel

Do the account preparation this week, buy the plan a few days before departure as described in buying an eSIM before you fly, and land with your number reachable and your data cheap.

Compare data-only plans by destination

Common questions