Evolution of SIM and ESIM Security: Authentication, Fraud, and Emerging Defenses

The transition of Subscriber Identity Module (SIM) technology from traditional physical cards to embedded SIMs (eSIMs) has brought significant advances in flexibility, scalability, and device interoperability within the telecommunications ecosys- tem, but it has simultaneously introduced critical challenges in terms of security and fraud prevention. Early research beginning in the early 2000s concentrated on vulnerabilities in GSM authentication mechanisms, demonstrating how attackers could exploit weaknesses in algorithms such as COMP128 to clone SIM cards and impersonate legitimate users. As mobile networks evolved into UMTS, LTE, and eventually 5G, studies revealed that although cryptographic protocols improved, attackers still leveraged human and organizational weaknesses, such as poorly implemented authentication checks by carriers, to perform SIM- swap fraud and account takeovers. In recent years, eSIM tech- nology and GSMA’s Remote SIM Provisioning (RSP) standard have enabled seamless subscription management and expanded use in the Internet of Things (IoT), but they have also widened the attack surface through new threats such as unauthorized provisioning and profile hijacking. This review analyzes research from 2002 onwards, emphasizing how early foundational works on cloning and authentication flaws paved the way for current investigations into eSIM security, large-scale fraud detection, and advanced defense frameworks. It highlights not only technical contributions but also socio-technical dimensions of fraud, con- cluding that although substantial progress has been made in protocol security, scalable fraud detection, and blockchain-based provisioning, there remains a persistent lack of real-time, user- centric defenses that empower individuals to counter hijacking attempts effectively.