askST: Are e-SIMs safe?

SINGAPORE - e-SIM cards are under scrutiny again after

the authorities launched an investigation into telco StarHub

over failing to verify the identity of users requesting to port their Giga e-SIMs to another phone.

For at least one customer, the lack of verification led to fraudsters taking control of the phone line and gaining access to information including banking SMS one-time passwords (OTPs), raising questions about the vulnerabilities of e-SIMs and whether users’ devices are secure.

Similarly, in 2023, an impersonator

took over a Circles.Life user’s mobile line by hijacking her e-SIM

and accessed her WhatsApp account and e-wallets, which were tied to her phone.

The Straits Times explains how e-SIM cards are issued and whether the technology is reliable.

1. How are e-SIMs installed on a device?

Digital SIM cards, or e-SIMs, are integrated into most modern smartphones built in the last five years, and can connect to a network almost immediately after users purchase a cellular data plan. They can activate the e-SIM by scanning a QR code provided by their network carrier, granting them access to a phone line and data plan.

Under the Law Enforcement and Other Matters Bill, mobile service providers are required to implement measures to

prevent fraudulent registration of physical or digital SIM cards,

such as to verify the identity of subscribers by checking their IDs. Authentication can also be done remotely via Singpass.

Passed in April, the law came on the back of a surge in cybercrimes involving local mobile lines that had led to some $400 million being lost in 2023. Close to 80 per cent of local SIM cards misused for crime were registered with another person’s particulars.

2. Are e-SIMs unsafe?

By design, e-SIMs are just as safe as physical SIM cards as the telco controls the issuing and activation of the SIM card.

While physical SIM cards can be lost, e-SIMs cannot easily be transferred between devices. e-SIMs are tied to the user’s device, making it tougher for fraudsters to take over a number.

The main reason past victims’ e-SIMs were hijacked is down to errors committed by telcos, such as failing to verify the identity of users while the digital cards were being ported to another device.

Most recently, StarHub was investigated by the Infocomm Media Development Authority (IMDA) over

its failure to verify the identity of Giga users porting their e-SIMs to another device.

Giga is StarHub’s budget sub-brand.

The error resulted in hackers taking control of phone lines and banking SMS OTPs.

Fraudsters can impersonate a user to hijack their e-SIM card.

In the

2023 case involving a Circles.Life user, an impersonator took over her mobile line

and accessed her WhatsApp account and e-wallets, which were tied to her phone. The fraudster was believed to have gained access to the victim’s account by providing her name, date of birth and NRIC number to request an OTP so as to be able to log in to her Circles.Life account, change the registered e-mail address and request an e-SIM and activate it.

3. What are the benefits of e-SIMs?

e-SIMs allow users to get hold of a new SIM card faster as they do not need to head to a telco outlet in person to pick up a physical card or wait for one to be delivered.

Most modern phones come with only a single physical SIM card slot. But with e-SIMs, users can install two SIMs, or two lines, on their device.

From a security standpoint, e-SIMs are tougher for fraudsters to tamper with as physical cards can be switched out, while e-SIMs are secure software embedded within a chip that is soldered to a device.

Most e-SIMs can be installed only once and need to be repurchased for a small fee if they are removed by accident. This makes it tougher for fraudsters to target e-SIMs and reassign them after they have been set up on a user’s device.

4. Are e-Sims safe for travellers to use?

Travel e-SIMs, which are mostly for short-term and one-time use, are generally safe.

Most digital SIMs made for travellers typically cannot be transferred between devices. Travel cards also do not usually require users to submit identity documents, eliminating the risk that a user’s personal details will fall into the wrong hands.

Most travel e-SIMs do not come with a phone line for receiving SMS OTPs. They offer cheap data plans and are

a hit with travellers.

5. When using e-SIMs, what are some personal safety practices?

Use e-SIMs from reputable service providers that offer a service hotline in case you have problems, such as activation difficulties or network connectivity problems.

Make sure to install on your device the app linked to your e-SIM, as the apps usually have tools to troubleshoot or diagnose common problems.

Customer support for no-frills plans can often be limited, with shorter operating hours and users interacting with chatbots for longer periods before being connected to a human service agent. This can be a hassle for users facing activation difficulties, especially those in different time zones.

Some short-term e-SIMs for travellers might not come with apps, so users should keep the mobile carrier’s website or contact on hand in case they need to reach it.