How to tell if an eSIM activation QR code or setup link is fake before you switch mobile service

Switching mobile service with an eSIM can be quick, but it also creates a new opportunity for scammers: fake activation QR codes, spoofed setup links and bogus customer-support messages. If you received an eSIM QR code by email, WhatsApp or SMS and you are not fully sure it came from your mobile provider, pause before scanning. In many cases, a few checks can help you spot a scam before you hand over personal details or move your number to the wrong account.

Key takeaway: Only use eSIM activation details from your carrier’s official app, website, store or confirmed support channel. If a QR code or link arrives unexpectedly, asks for urgent action, or sends you to a lookalike site, verify it directly with the provider before you continue.

Why fake eSIM setup messages are risky

An eSIM activation QR code is meant to add a mobile plan to your device. On its own, a QR code is not automatically malicious, but scammers can use fake ones to push you to phishing pages, collect account details, or trick you into approving changes you did not intend.

This matters because mobile numbers are tied to banking alerts, OTPs, messaging apps and account recovery. The UK’s National Cyber Security Centre warns that scam messages often try to create urgency and push people into clicking links or sharing personal information, which is exactly how many fake setup messages work (NCSC guidance). The U.S. Cybersecurity and Infrastructure Security Agency also advises users to be cautious with links and attachments in unsolicited communications (CISA phishing guidance).

If you are unsure about a setup link, you can check it first with the LinkExpln scanner or review how LinkExpln works before opening it.

Illustrative image (AI-generated).

The most common signs an eSIM QR code or setup link may be fake

1. It arrived unexpectedly

If you did not request an eSIM transfer, SIM replacement or new activation, treat the message as suspicious. Many scams start with an unsolicited email, text or WhatsApp message claiming your number must be moved immediately.

2. The sender pushes urgency

Messages such as “activate in 10 minutes or your SIM will be blocked” are a classic pressure tactic. Real telecom providers may send time-sensitive instructions, but they usually do not threaten immediate suspension through random chat messages or unverified links.

3. The link does not match the provider’s real domain

Before tapping, look closely at the web address. Scammers often use slight misspellings, extra words, strange subdomains or unrelated domains.

Examples:

• yourcarrier-support.example.com instead of the provider’s main domain
• domains with extra hyphens or letters
• shortened links that hide the destination

Google’s own safety guidance recommends checking URLs carefully and avoiding suspicious links (Google account safety tips).

4. The message asks for login details, OTPs or ID documents in the wrong place

Some carriers require identity checks for SIM or eSIM changes, but be wary if a message asks you to send OTPs, passwords, card details, Aadhaar scans or app login codes through email, SMS or chat. In India, the RBI repeatedly warns users not to share OTPs and other sensitive credentials with anyone (RBI customer awareness).

5. The QR code comes as a random image attachment

A legitimate provider may send an activation QR code by email, but context matters. If the email is poorly written, uses a generic greeting, comes from a strange sender address, or includes extra login/payment requests, do not scan it yet.

6. The site asks for payment to “release” your eSIM

Unexpected fees, especially through UPI, gift cards, wallet transfers or manual bank transfer, are a major red flag. If there is a real activation charge, it should appear through the carrier’s normal billing or official checkout flow.

How to verify an eSIM activation QR code or setup link safely

Step 1: Stop and check whether you initiated the request

Ask yourself:

• Did I request a new connection, port, SIM swap or device transfer?
• Was I expecting an activation email or QR code?
• Did I contact the carrier first through its official app, website or store?

If the answer is no, do not scan the QR code.

Step 2: Verify the message source independently

Do not reply to the same message to “confirm” it. Instead:

• open your carrier’s official app
• visit the provider’s official website by typing it yourself
• call the customer-care number listed on the official site or your bill
• visit a physical store if needed

This avoids the common trap of calling fake support numbers included in scam messages.

Step 3: Inspect the sender and destination carefully

Check:

• the full email address, not just the display name
• the full domain name of the link
• whether the page uses the provider’s normal branding and sign-in flow
• whether the page asks for unusual information

If a link looks odd, avoid opening it directly. You can submit it to the LinkExpln scanner or report a suspicious link if you think others may receive it too.

Step 4: Never share OTPs or account recovery codes

A genuine activation process may require you to log in to your own account on the provider’s official site or app. That is different from sending OTPs to a person over chat, phone or email. If someone asks you to read out a one-time code to “complete eSIM verification,” stop immediately.

Step 5: Confirm device instructions with official help pages

Many eSIM scams work because the setup steps seem technical and unfamiliar. Compare what you received with the official device and carrier instructions. For example, Google provides standard guidance on setting up eSIM on supported Android devices through its official help pages (Google eSIM help). If the message tells you to install unusual apps, change unrelated settings, or disable security features, that is not normal.

Illustrative example of a suspicious eSIM message

Illustrative example:

Your eSIM request is pending. Scan attached QR within 15 minutes to avoid service disconnection. If code fails, verify your identity here: carrier-esim-verify-login.example and share OTP with support agent.

Why this is suspicious:

• creates panic
• uses a non-official-looking domain
• asks for OTP sharing
• threatens disconnection
• mixes technical setup with identity harvesting

What to do if you already scanned a fake eSIM QR code or clicked the link

Act quickly, but do not panic.

1. Contact your mobile provider through official channels

Tell them you may have interacted with a fraudulent eSIM setup message. Ask them to:

• check for SIM swap or eSIM transfer requests
• lock or reverse unauthorized changes if possible
• add extra verification to your account

2. Change important passwords

Start with:

• your mobile carrier account
• primary email account
• banking and payment apps
• messaging apps tied to your number

3. Watch for signs of account takeover

Look for:

• loss of signal on your phone without explanation
• login alerts from email or banking services
• messages saying your number was moved or settings changed

4. Report the incident

If you are in India, you can report cyber fraud at the government’s cybercrime portal (National Cyber Crime Reporting Portal). If money is at risk, contact your bank immediately as well.

5. Run a broader safety check

If you downloaded anything from the fake page, uninstall suspicious apps and review your phone permissions. You can also review general security practices for safer browsing and message handling.

Best practices when switching mobile service with eSIM

To reduce risk in future:

• initiate the switch yourself from the carrier’s official app or website
• avoid setup links sent through forwarded messages or unofficial groups
• keep your carrier account protected with a strong password
• turn on extra account security options if available
• do not let anyone “help” you activate eSIM by taking your OTPs
• save the official customer-care number before you begin the switch

FAQ

Can a QR code itself hack my phone?

Usually, a QR code is just a way to encode information such as a setup address or activation data. The main risk is where it leads you or what process it starts. That is why the source and destination matter so much.

Is it safe if the message uses my real provider’s name and logo?

Not by itself. Scammers often copy branding. Always verify the sender address, domain and instructions through the provider’s official app or website.

What if I am porting my number and expect an eSIM email?

Even then, verify that it matches the process you started. If anything is different, contact the provider using independently sourced contact details before scanning.

Conclusion

A real eSIM activation QR code should fit a process you started and should come from a source you can independently verify. If a setup link or QR code arrives unexpectedly, pressures you to act fast, or asks for OTPs or unusual payments, treat it as suspicious and confirm with your mobile provider first. When in doubt, check the link before you open it and stick to official channels for the final activation step.