I don't want to faff around with physical SIMs, so I went looking for the cheapest way to keep my number for the longest time. There are a whole bunch of providers out there who will do low-cost monthly contracts (like Spusu), which I don't want. Similarly, there are some pure PAYG providers who require you to top-up with £10 every few months (like 1pmobile).

In the end, I went with Lyca Mobile (affiliate link). Total cost was £10 which should last indefinitely.

The process isn't particularly straightforward. Here's how it works:

First, add a PAYG SIM to your basket and select "eSIM"

Next, click the Bin icon (🗑) in the top right. You'll get this pop-up:

Select "Discard plan & add credit" - you'll return to this screen:

The minimum top-up is a tenner, so select that. From there, you can add details of your old number, its porting code, and when you want the port to take place. Then pay.

Done! You'll receive your eSIM instantly. Scan it with your phone and you'll be up and running. The phone number porting will take as long as it takes.

OK, but will Lyca let you keep a number indefinitely? Here's what they say:

How long can I keep my number for if I don’t use any of Lyca Mobile’s services?

Normally we will keep your number for 120 days if you do not use our service. However, you may also keep your Lycamobile number for up to 1 year without using our service. Just dial *139*9999# from your Lycamobile and follow the instructions on the screen. Please be aware that there will be a fixed annual fee of £15 which will be deducted from your balance.

Source

Note, their chatbot says the fixed fee is a fiver. Like all half-baked AI systems, it is wrong.

So, what does "using" consist of? This is hard to find out! I think is any chargeable event. Based on their current PAYG pricing the cheapest options are:

• Send an SMS for 23p
• Use 1MB of data for 15p.

If I'm right, you could use 1MB of data every 120 days. That would deplete your credit in about 22 years. More than long enough for me!

There you have it, I'm pretty sure that's the cheapest way to keep a UK mobile number on an eSIM. You can keep it switched off for 119 days, flick it on, send a quick message, then shut it down again.

Click the referral link to join Lyca Mobile

EE texted to say they had processed my sim activation request, and the new sim would be active in 24 hours. I was told to contact them if I hadn’t requested this. I hadn’t, so I did so immediately. Twenty-four hours later, my mobile stopped working and money was withdrawn from my bank account.

With their alien sim, the ­fraudster infiltrated my handset and stole details for every account I had. Passwords and logins had been changed for my finance, retail and some social media accounts.

(Emphasis added.)

I realise it is in the consumer rights section of the newspaper, not the technology section, and I dare-say some editorialising has gone on, but that's nonsense.

Here's how a SIM swap works.

1. Attacker convinces your phone company to reassign your telephone number to a new SIM.
2. Attacker goes to a website where you have an account, and initiates a password reset.
3. Website sends a verification code to your phone number, which is now in the hands of the attacker.
4. Attacker supplies verification code and gets into your account.

Do you notice the missing step there?

At no point does the attacker "infiltrate" your handset. Your handset is still in your possession. The SIM is dead, but that doesn't give the attacker access to the phone itself. There is simply no way for someone to put a new SIM into their phone and automatically get access to your device.

Try it now. Take your SIM out of your phone and put it into a new one. Do all of your apps suddenly appear? Are your usernames and passwords visible to you? No.

There are ways to transfer your data from an iPhone or Android - but they require a lot more work than swapping a SIM.

So how did the attacker know which websites to target and what username to use?

What (Probably) Happened

Let's assume the person in the article didn't have malware on their device and hadn't handed over all their details to a cold caller.

The most obvious answer is that the attacker already knew the victim's email address. Maybe the victim gave out their phone number and email to some dodgy site, or they're listed on their contact page, or something like that.

The attacker now has two routes.

First is "hit and hope". They try the email address on hundreds of popular sites' password reset page until they get a match. That's time-consuming given the vast volume of websites.

Second is targetting your email. If the attacker can get into your email, they can see which sites you use, who your bank is, and where you shop. They can target those specific sites, perform a password reset, and get your details.

I strongly suspect it is the latter which has happened. The swapped SIM was used to reset the victim's email password. Once in the email, all the accounts were easily found. At no point was the handset broken into.

What can I do to protect myself?

It is important to realise that there's nothing you can do to prevent a SIM-swap attack! Your phone company is probably incompetent and their staff can easily be bribed. You do not control your phone number. If you get hit by a SIM swap, it almost certainly isn't your fault.

So here are some practical steps anyone can take to reduce the likelihood and effectiveness of this class of attack:

• Remember that it's OK to lie to WiFi providers and other people who ask for your details. You don't need to give someone your email for a receipt. You don't need to hand over your real phone number on a survey. This is the most important thing you can do.
• Try to hack yourself. How easy would it be for an attacker who had stolen your phone number to also steal your email address? Open up a private browser window and try to reset your email password. What do you notice? How could you secure yourself better?
• Don't use SMS for two-factor authentication. If you are given a choice of 2FA methods, use a dedicated app. If the only option you're given is SMS - contact the company to complain, or leave for a different provider.
• Don't rely on a setting a PIN for your SIM. The PIN only protects the physical SIM from being moved to a new device; it does nothing to stop your number being ported to a new SIM.
• Finally, realise that professional criminals only need to be lucky once but you need to be lucky all the time.

Stay safe out there.

Yes, users should probably take better care of their digital credentials and bury them in a digital vault. But there are some things which are simply impossible for a user to protect against. Take, for example, a SIM-swap attack.

You probably have your phone-number tied to all sorts of important services. If you want to recover your email, log in to a bank, or prove your identity - you'll probably need to receive a call or SMS. If an attacker can take over your phone number, they're one step closer to taking over your accounts.

I keep saying "your phone number", but that's a clever lie. The phone number does not belong to you. It belongs to the network operator and they define which SIM the number points to.

This means a suitably authorised person at the telco can point "your" number to a new SIM card. That's helpful if you've lost your SIM but bad if an attacker wants to divert your number.

What can you do to stop this attack? Nothing.

Oh, you can have a strong and unique password on your account, and you can hope your telco uses TOTP and PassKeys. But it turns out that it is possible to bribe telco employees for the low, low price of US$1000.

If your security rests on a phone number, you've effectively outsourced your security to the most bribeable manager employed by your telco.

Now, I said there's nothing you can do. That isn't quite true. You can attempt to pen-test yourself.

Go to your phone company's account. Set a long password and complex password. Change your mother's maiden name to HK2BY@]'PU,:!VQ;}baTj. Turn on every security measure you can find. Call the phone company from a different phone and explain that you lost your phone and want a new SIM card. If they ask for your mother's maiden name, say "Oh, I set it to a long stream of gibberish". If they ask where to send the SIM, give a trusted friend's address. If your phone company is negligent and send out a new SIM on the basis of poor verification, then you should move your number to a more reputable provider.

It's good fun to try and social-engineer a call-centre worker for your own details. But it's probably illegal to try and bribe someone to hijack yourself.

Anyway, please try to remove your phone number as a critical lynchpin in your security regime.

I find dual-SIM phones handy. I have a disposable number which I give out to people who don't need my main number. And when I go abroad, it's useful to have a local SIM. When I'm at home, I like my 2nd SIM to be used as a backup in case I'm somewhere with no signal on my primary line.

So, what's the cheapest eSIM in the UK?

I think it is Spusu - an MVNO on the EE network. 1GB, Unlimited Minutes, Unlimited SMS for... £2.90 per month!

Not bad! It offers 5G, VoLTE, WiFi Calling and EU roaming. If you spend most of your day on WiFi, it's a great offer. The contract is flexible, so you can cancel it at any time.

There are a few others to consider.

Lyca - another EE MVNO - have a special offer of £1.29 per month but that's only for the first 3 months. After that it jumps to £5.90. It should be possible to cancel after the first few months, but that's a bit of hassle.

GiffGaff are an O2 MVNO. They offer a free SIM, which you can convert to an eSIM. That will get you a number which supports incoming calls and texts - but you won't be able to make calls, send texts, or use data. Their cheapest monthly plan is £6. Or you can go pure PAYG and pay 25p/min for calls, 10p per text, and 25p per MB. Ouch!

Three will also give you a free eSIM. At PAYG rates, you'll pay 35p/min, 15p/text, 10p/MB.

If you want a data-only backup eSIM, I think the cheapest is £6.50 for 30 days with 3GB from Nomad. It is designed for tourists - and will roam onto all the major UK networks. No calls or texts, but handy if you need emergency data.

Those are the cheapest deals I could find. If you think you know of something cheaper - shove a link in the comments.

I started to panic. All my apes money gone!

No. Wait. The other thing. I knew it was a scam from the moment "James from your bank's fraud team" started his patter.

You see, I have multiple phone numbers. And "James" called me on a number which isn't tied to my bank. So I strung him along for half an hour or so pretending to move my money into a safe account, taking ages to wait for an SMS confirmation code, accidentally reading out the wrong one, before cursing him and his lineage even unto the seventh generation. He, in return, introduced me to a whole new range of swearwords from his native tongue and hung up on me. Charming!

Here's how it works, and how you can use this trick.

The easiest way is to get a dual SIM phone. I have my main SIM which holds my primary phone number. That's the number used by my family, my banks, and anyone vaguely trustworthy. My second SIM contains a free disposable PAYG SIM.

That phone number gets given out to retailers, couriers, Gumtree & Freecycle users, pizza delivery, and anyone else who doesn't need my number permanently.

My Android phone tells me which line is being called. And once I start getting too much spam to that number I throw the SIM away and get a new one with a new number.

If you have an eSIM, you can do the same thing. Find a cheap eSIM provider, sign up to a PAYG or monthly plan, then ditch the number whenever you like.

Or, you can set up a SIP calling plan. Install an app and have calls automatically routed to you.

About a dozen years ago, I worked with a UK mobile network to develop "disposable" phone numbers. The idea was that we would partner with, say, a dating app and generate a new phone number for you. Your date could call and text you without you having to reveal your real number. If they turned out to be a jerk, you could revoke the phone number immediately.

The same tech could work for hiring a plumber, getting a takeaway, or a hundred different use cases. The plan was to have an app which displayed a push-notification telling you which number was being called - so you knew if it was from your temporary lover or the person picking up your old sofa.

Sadly, the demo never went anywhere. It's a pity. I'd love to have a SIM with multiple disposable numbers.

But, for now, give out your temporary number to people who don't need a way to permanently contact you. Better safe than sorry!

Here's the best data deals that I could find. Stick them in your 2nd SIM slot, use them as broadband backup, or shove in a dongle and attach to a Raspberry Pi.

If you want the cheapest data - it's got to be EE. Less than a quarter of the price-per-GB than Three.

For the cheapest per-month equivalent - there's nothing between Three or Vodafone. Just pick whoever gives you best coverage.

Worth also checking whether the network you choose supports 5G on their pre-paid SIMS. Same for roaming. Some do, some don't - it's not always clear from their websites.

I'm not sure if I can physically use 120GB in a year given that I'm mostly WFH. So I think I might give Vodafone a go.

If you've spotted any better deals - please let me know in the comments below.

If you are in the UK, you must have an active SIM in your phone!

Your SIM does not need to be in credit, but it does need to be active. That is, it will connect to your network provider.

If you do not have any coverage from your provider, other networks will automatically let you on to make an emergency call only if you have a SIM card.

Why?

This is a decision by Ofcom - the organisation which regulates telecoms in the UK. It was taken to reduce hoax calls.

evidence from Europe suggests that the incidence of hoax calls is higher where a mobile phone does not have a SIM card.

This suggests that one approach is to only extend 999 mobile roaming to mobile phones with an active SIM card.

Access and Inclusion Digital communications for all - 2009 - §8.46

You can read further details about the evidence and how the UK and other EU countries deal with this.

Testing this

If you don't believe me or the resources I've listed, you can pull the SIM from your phone and then try to connect to the emergency services. It should be impossible in the UK.

Remember - making hoax calls to the emergency services is illegal.

Alternatives

If you have a valid SIM card in your mobile, you can also send text messages to the 999 service - although you will need to register for this service.

The SIM is designed to do a number of things; encryption, address storage, hold SMS, etc.

Most importantly, it's designed to be swappable. With GSM, you can choose your phone and your network provider separately. Want the iPhone? Hate Three's network? Stick in a Tesco Mobile SIM. Love Vodafone? Think their range of phones is crap? Buy the phone and service separately.

It means carries and manufacturers don't have control of customer behaviour. This is a good thing and allows our form of free-market capitalism to flourish with increased competition.

The reason that Apple claim their iPhone needed a micro-SIM was that the space inside the iPhone was too cramped for a regular SIM. This is hogwash.

The size saved by the mico-SIM is miniscule. It was originally intended for small or embedded devices where space was at a premium. While the iPhone is a complex bit of kit, the SIM tray is already close to the size of the full SIM. It's simply not credible that the iPhone was unique and had to have a new SIM.

So what was the purpose?

Apple want to control the entire experience. You buy the Apple iPhone in the Apple Store. You download music and games from Apple's iTunes. You send messages over Apple iMessage and Facetime. They want a 100% Apple experience.

When the iPhone was limited to a single carrier per market, they also had that control over the networks. They could (and did) dictate how much the monthly tariff cost. How many minutes, texts, and MB an iPhone user would have. They even prevented the phone being sold to PAYG customers.

You may have thought you were on O2, but you were really on an Apple MVNO.

That has (mostly) changed now. You can get an iPhone and put it on any network, at any price point, with any services and wrest control from Apple. And they hate losing control.

The micro-SIM was their first move. Use a SIM which cannot be swapped with any other phone. Make it hard enough to get a normal SIM into an iPhone that most people won't bother. Yes, there are SIM cutters and caddies - this is an imperfect solution they foisted on to the marketplace. One which is backfiring as other manufacturers start using the micro-SIM.

Their next move is a phone with a "Virtual SIM" - Tomi Ahonen has a little bit of background - no physical SIM card to be swapped.

It's quite simple technically. You buy your iPhone, plug it into iTunes, and tell it which price-plan you want. You pay Apple directly and they update the iPhone's "Virtual SIM". Hey presto, you're on the network.

What network? Who knows! As far as you're concerned, you're on Apple. It may be Vodafone, it may be O2. And, at any moment, Apple could update the Virtual SIM and you'd be on T-Mobile.

I've Got A Bad Feeling About This

There are several reasons why the Virtual SIM is a dangerous idea.

• If you're unlucky enough to live in an area with bad reception from Orange? Too bad. All the people who matter live in cities with excellent reception...
• Reduced choice in price-plans.
• Zero competition in price.
• Security. Networks are very reluctant to give their encryption keys to Apple. Considering how easy it is to jailbrake an iPhone, this is wise.
• If or when Apple go bust - you may be left with a brick. There will be no way to update it.
• Roaming costs. Maybe Apple will do a deal with international roaming operators and reduce cost? If they don't, there's no way you can swap to a domestic SIM.
• Want to move your number to a disposable phone if you're going partying / sailing / camping? Tough. The number stays with the phone.
• When Apple decide to up their prices - you can't leave for another provider.
• Phone damaged? No easy way to move your number to another handset.
• I think you get the picture.

Luckily the operators kicked the proposal into the long grass. But I know that several parties are interested in Virtual SIMs - it's a zombie idea which will keep coming back unless we kill it with fire.

This is terrible for customers - but you can see why Apple love it so.

The Kindle Conundrum

I've used Apple as a convenient scapegoat here. They're not the only ones planning for a virtual SIM. In some ways, the Amazon Kindle was the first to try this strategy in the UK. As I've blogged about, the Kindle has a non-removeable SIM card. Well, you can remove it if you're handy with a screwdriver and don't mind voiding your warranty.

In this case, Amazon have an exclusive deal with Vodafone to provide worldwide 3G roaming on their network. If the SIM was replaced, the customer would have to pay the roaming bills.

The Kindle can only work with Amazon's services - all the browsing goes through their proxy - but that doesn't necessarily mean that it couldn't use a 3rd party SIM card. If you've no Vodafone reception or WiFi at home, it may even be worth your while paying O2 for a data-only SIM.

But the Kindle is sold as a single service. So it's acceptable. Barely.

Future Imperfect

I dread the future where devices are locked down like American CDMA phones. No choice other than what the manufacturer demands. Gone will be the days of choosing the right phone and the right price-plan. You'll take the service you're given and will have to put up with it.

For now, the operators are on the side of consumers against manufacturers. But it only takes one to start us down that slippery slope.