eSim Phishing?

An eSIM is provided and activated by your mobile carrier, not by Apple. While the iPhone provides the technology and settings needed to store and use an eSIM, the carrier controls whether an eSIM can be issued, added, transferred, or activated on your account. Apple does not decide which eSIM your carrier adds to your iPhone, nor does Apple have control over your carrier’s eSIM provisioning process.

Therefore, if you notice that an unknown or unexpected eSIM has been added to your iPhone, I would not recommend treating it as an Apple issue or simply posting about it on an Apple forum. Your first step should be to contact your mobile carrier immediately and tell them that an eSIM appears to have been added to your account/device without your knowledge or authorization. Ask the carrier to verify the eSIM, determine when and how it was provisioned, and check whether there has been any unauthorized activity on your mobile account.

I would not automatically assume that this is a phishing attack. A phishing attack generally involves an attempt to trick you into providing sensitive information—such as your Apple Account credentials, passwords, verification codes, or financial information. Simply finding an unfamiliar eSIM on an iPhone does not, by itself, establish that phishing has occurred.

However, if you did not request, approve, or initiate the addition of that eSIM, it should be treated as a security concern until your carrier confirms what happened. In particular, ask the carrier to check whether someone has gained unauthorized access to your mobile account or attempted a SIM/eSIM transfer.

If you did personally scan a QR code, follow a link, use a carrier app, or otherwise initiate the eSIM installation, then the circumstances are different, and you should investigate where that eSIM activation request originated before assuming it was unauthorized.