How to spot eSIM, roaming, and verification-code scams

Notice the pattern, not just the logo

A scam message can use a real carrier name, a copied logo, and details it found elsewhere. Look for the pressure: “scan now,” “your number will be shut off today,” “read the code back,” or “move money to protect your account.” Those demands are more useful clues than a polished design.

ENISA includes “quishing,” or QR-code phishing, among the phishing forms consumers should recognise. A QR code can send a phone to a website or activation flow, so do not scan a sticker, flyer, email image, or social post merely because it looks technical. Go to the provider’s site or app yourself and look for the same action.

Verification codes are for you to enter

A code sent to your phone or email often proves that a sign-in or account change is happening. It is not something an unsolicited caller needs you to read aloud. The FTC’s advice is direct: if someone asks for your verification code, do not engage; use a number you already trust if you need to check an account.

Similarly, never approve a push notification you did not initiate. A real support team may have account-verification processes, but do not normalize sharing a one-time code with an unexpected contact. End the call or chat, then begin a fresh conversation through the provider’s official app, printed statement, or official website.

Use an independent route to check

In the UK, Ofcom advises people who receive a suspicious message to stop, avoid clicking links or replying, and report suspicious SMS to 7726. Reporting channels differ elsewhere, so use your country’s telecom regulator, consumer-protection body, carrier, or messaging app’s report tool. Do not claim that 7726 works outside the UK.

If you clicked a link, installed an app, or shared account information, start with the eSIM account-takeover response plan. For QR-specific prevention, use the safe QR setup guide. Strengthen the carrier account with SIM-swap protection steps before the next trip.