Safety of e-SIMs under spotlight

e-SIM cards are under scrutiny again after the authorities launched an investigation into telco StarHub over failing to verify the identity of users requesting to port their Giga e-SIMs to another phone.

- Osmond Chia

For at least one customer, the lack of verification led to fraudsters taking control of the phone line and gaining access to information including banking SMS one-time passwords (OTPs), raising questions about the vulnerabilities of e-SIMs and whether users' devices are secure.

Similarly, in 2023, an impersonator took over a Circles.Life user's mobile line by hijacking her e-SIM and accessed her WhatsApp account and e-wallets, which were tied to her phone.

The Straits Times explains how e-SIM cards are issued and whether the technology is reliable.

Q How are e-SIMs installed on a device?

A Digital SIM cards, or e-SIMs, are integrated into most modern smartphones built in the last five years, and can connect to a network almost immediately after users purchase a cellular data plan.

They can activate the e-SIM by scanning a QR code provided by their network carrier, granting them access to a phone line and data plan.

Under the Law Enforcement and Other Matters Bill, mobile service providers are required to implement measures to prevent fraudulent registration of physical or digital SIM cards, such as to verify the identity of subscribers by checking their IDs. Authentication can also be done remotely via Singpass.

Passed in April, the law came on the back of a surge in cybercrimes involving local mobile lines that had led to some $400 million being lost in 2023. Close to 80 per cent of local SIM cards misused for crime were registered with another person's particulars.