Wider eSIM adoption creates an important challenge for telecom operators: how do you know that the person remotely activating or transferring a mobile subscription is really the customer? With a physical SIM, the customer journey traditionally included physical processes such as manufacturing, distribution and delivery of the SIM card. With eSIM, a mobile subscription can be provisioned remotely to a compatible device. This makes activation faster and more convenient, but it also means operators increasingly need to establish customer identity without relying on physical interactions.

That challenge is becoming more urgent as eSIM adoption accelerates. GSMA Intelligence expects eSIM’s share of smartphone connections to rise from 5% at the end of 2025 to 10% by the end of 2026. As device manufacturers increasingly support eSIM-first and eSIM-only experiences, operators need fraud controls designed for customer journeys that may take place entirely online.

The issue is not that eSIM is inherently insecure. Many threats, including identity fraud, account takeover and SIM-swap fraud, existed long before eSIM. What changes is the way operators manage those risks. When activation, account recovery and SIM transfers happen remotely, securing the eSIM profile is only part of the challenge. Operators also need sufficient confidence that the person requesting a high-risk action is the legitimate customer.

This is where identity verification becomes important. Authentication can establish that someone has access to particular credentials, while fraud systems can identify suspicious behaviour. For higher-risk actions, identity verification can provide an additional layer of assurance that the person behind the request is who they claim to be.

Candour’s ID verification is designed to provide that additional assurance at the moments where it matters most, helping operators strengthen remote activations, account recoveries and other high-risk customer journeys without introducing unnecessary verification into every interaction.

Identity Fraud Doesn’t End at Onboarding

A customer applying for a mobile subscription online may provide a valid name, address and identity document, but valid information does not necessarily mean that the person presenting it is the legitimate identity holder. Stolen personal information or identity documents can allow a fraudulent applicant to appear genuine. Checking whether the information is valid and verifying the person behind it are therefore two different things.

Moreover, the risk does not always end at onboarding. A legitimate account can be targeted years later during account recovery, a device change, SIM replacement or eSIM activation. SIM swap fraud is a clear example: Moving a number between devices is a legitimate service, but it becomes fraud when an attacker convinces a Telecom operator to transfer someone else’s number. At that point, a telecom fraud problem can quickly reach far beyond the mobile account.

Why SIM Swap Fraud Goes Beyond the Mobile Account

The risk extends beyond the mobile account because phone numbers are widely used for authentication and account recovery. Banks send security messages to them, online services use them for account recovery, social media platforms use them for identity checks, and many services still rely on SMS one-time codes. That makes control of someone’s number surprisingly powerful.

The European Union Agency for Cybersecurity (ENISA) warns that SIM swap fraud can allow criminals to receive a victim’s calls and SMS (Countering SIM-Swapping | ENISA). Once an attacker controls the number, it can possibly support:

• Account takeover where a mobile number is used for authentication or recovery.
• Interception of SMS one-time codes and security alerts.
• Financial fraud through linked services.
• Social recovery of other accounts associated with the number.

That’s why telecom fraud prevention goes beyond protecting the operator’s own account. Operators can’t secure every bank, email provider or online platform connected to a customer’s number. What they can do is protect critical details when that number is issued, recovered or transferred. The answer is not simply to add more verification everywhere. Customers choose digital services for convenience. Therefore, if every action suddenly requires another identity check, much of what makes eSIM attractive disappears.

A Risk-Based Approach to Identity Verification

Operators can improve security without making every interaction more complicated by adjusting verification based on the level of risk. Checking a data allowance doesn’t carry the same risk as recovering an account or moving a number to a new device. Since the consequences are different, the level of verification should be too.

That makes digital identity verification much more practical. It keeps everyday interactions simple, but introduces stronger checks when an action could establish or transfer meaningful control, such as:

• Onboarding a new customer remotely.
• Activating or replacing a SIM or eSIM.
• Moving a mobile number to another device.
• Recovering access to an account.
• Changing important identity or account information.
• Responding to unusual behavior, device, or fraud signals.

Verification also shouldn’t end once a customer has signed up. Confirming someone’s identity at onboarding doesn’t mean they’ll be the same person trying to recover the account two years later. A stronger approach is to keep checking identity when it matters, using tools such as biometric KYC, real-time identity checks, analytics and risk-based authentication. The advantage is that stronger assurance doesn’t have to mean more friction for everyone. It can be introduced when the risk calls for it, within the same digital journey.

Where Candour Identity Fits

Candour’s ID verification combines facial verification with passive liveness detection to help establish that a real person is present and corresponds with the identity being verified. This gives telecom operators an additional layer of assurance alongside their existing authentication, device and fraud controls.

A routine account action may not need any extra verification. But a request to activate a new eSIM on another device, or recover an account when there are signs of unusual activity, may need a stronger check. Biometric identity verification adds another layer of confidence by helping answer a simple question: are we sure the person making this request is really the account holder?

Candour’s ID verification can be integrated through APIs, SDKs and web implementations, with deployment options for different infrastructure and data requirements. Its underlying biometric technology has achieved FIDO (LEVEL 1, TYPE 1, V4.0) certification and recorded a 0.00% False Acceptance Rate (FAR) during the certification evaluation. That result relates specifically to the certification test and does not mean that any identity technology can eliminate fraud entirely.

Telia Shows How It Can Work in Practice

Candour’s collaboration with Telia shows how additional assurance can fit into an existing customer journey. In September 2026, Telia introduced an additional verification step for certain Mobile certificate activations, with Candour providing the Identity verification technology. The aim was to strengthen protection against misuse and fraud, including risks linked to Mobile certificate activation on eSIM subscriptions.

The sequence is what makes it interesting. Customers first authenticate using online banking credentials. When additional assurance is required, they can then be asked to verify their identity using an accepted document, such as a passport or national identity card, with Candour providing the technology behind that step.

Each control has a different job. Authentication establishes access, fraud systems identify suspicious signals, and identity verification adds confidence in the person when the situation calls for it. That means stronger security can be introduced where it matters without making every customer prove who they are at every interaction!

Securing eSIM Without Adding Unnecessary Friction

Effective eSIM fraud prevention isn’t about adding extra verification to every customer action. It’s about using stronger identity checks when the potential risk is higher. As device manufacturers continue moving towards eSIM-first and eSIM-only experiences, more mobile journeys will happen digitally. Operators need practical ways to make sure that the person behind a high-risk request is genuinely the customer.

Candour Identity gives operators a way to add biometric identity verification at higher-risk points, such as remote activation, account recovery and number transfers, while keeping everyday interactions simple. As eSIM adoption continues to grow, this risk-based approach can help operators improve fraud protection without adding unnecessary steps or taking away from the convenience that makes eSIM appealing to customers.