Travel eSIMs have become the easy way to get mobile data abroad: buy a plan online, scan a QR code, and your phone connects when you land. Many travellers assume that a "Japan eSIM" or a "Turkey eSIM" means their data goes through a Japanese or Turkish operator. New testing published in October 2026 suggests that, for most travel eSIMs, that assumption is wrong.

This article explains what the research found, why it matters for your privacy and for the apps you use, and what you can sensibly do about it. It also covers a separate rule in Russia that affects SIM cards coming back from abroad.

How travel eSIMs work

An eSIM is a SIM card built into your phone. Instead of inserting a plastic card, you download a profile. Many travel eSIMs are sold by resellers, companies that buy access from mobile operators and package it into plans for travellers.

Often the profile belongs to an operator in a different country, and your phone uses the local network through a roaming agreement. With roaming, your data can travel back to the home operator's network, or to another location it chooses, before it reaches the internet. That is normal in mobile networks, but it means the country you are standing in and the country your data exits from can be different.

What the October 2026 testing found

Taiwan News reported on 7 October 2026 that Taiwan's Consumers' Foundation tested 172 eSIMs sold to travellers heading to popular destinations. Only 27.9% used networks registered to operators in the advertised countries; in other words, more than 70% did not. Most connected through roaming in third countries or regions, or through networks registered elsewhere. About 40% used networks run by Chinese state-owned telecom groups, including China Mobile.

The report also said Taiwan's Ministry of Digital Affairs had warned in July 2026 that eSIMs may route users' traffic to servers in third countries before forwarding it to local networks. The foundation urged authorities to require eSIM providers to disclose the operator, how data is transmitted and whether traffic is roamed through a third region.

What academic research adds

This is not only a consumer-testing finding. A paper presented at USENIX Security 2025, a major computer security conference, by Maryam Motallebighomi, Jason Veara, Evangelos Bitsikas and Aanjhan Ranganathan of Northeastern University studied the travel eSIM ecosystem. They wrote that travel eSIMs often route user data through third-party networks, including Chinese infrastructure, regardless of the user's location, which raises concerns about jurisdictional exposure.

The researchers also documented that, because provisioning workflows are opaque, resellers can access sensitive user data, communicate with devices and assign public IP addresses without users being aware of it.

What this means for you

Your traffic may be subject to another country's rules

If your data exits through a network in a third country, the operator there handles your connection, and that country's laws apply to it. HTTPS still encrypts the content of most websites and apps, but the operator can see metadata such as which servers you connect to and when.

You may appear to be somewhere else

Websites and apps see the public IP address your traffic exits from. With a roamed eSIM, that address may belong to a different country than the one you are in. Banking apps can ask for extra checks, shops can show prices for another region, and some services may refuse to work. We explain why services react this way in Why some apps refuse to work with a VPN; the same logic applies to unexpected foreign IPs.

The reseller is part of the chain

Your eSIM seller is not just a shop. According to the USENIX research, resellers can have access to sensitive data and control over parts of the connection, so the reseller's trustworthiness matters as much as the operator's.

A separate issue: Russia's 24-hour SIM block after travel

Travellers returning to Russia face a different problem. Novaya Gazeta Europe reported on 11 November 2025 that the Digital Development Ministry had introduced a 24-hour block on mobile internet and SMS for SIM cards returning from abroad and for cards that had not been used for 72 hours. Users could lift the block earlier by completing a captcha sent by their operator, though one outlet reported that one operator's link did not seem to work. In October 2025, foreign SIM cards had been blocked from data and texting for 24 hours after entering Russia. The ministry's stated reason was to prevent SIM cards from being used to navigate drones.

These rules may have changed since November 2025. If you travel to or from Russia, check your operator's current guidance, keep important information available offline and plan for a day without mobile data.

Sensible precautions

  • Ask before you buy. Choose a provider that names the network operator and says whether traffic is roamed through another country. If it won't tell you, take that into account.
  • Check where you appear to be. After connecting, open What is my IP to see your public address, and use IP lookup to see which network and country it belongs to.
  • Be careful with sensitive tasks. The Consumers' Foundation advised avoiding online banking and card payments unless you can confirm the network is secure. Use HTTPS sites and official apps.
  • Consider a VPN you trust. The foundation also suggested using HTTPS or a VPN where possible. A VPN encrypts your traffic between your phone and the VPN server, so the roaming operator sees less. It does not change who carries your data, so it complements choosing a transparent provider rather than replacing it.
  • Prefer a named local carrier for long stays. A local SIM or eSIM from an operator in the country you are visiting keeps your traffic on that country's network.
  • Remove old profiles. Delete travel eSIM profiles you no longer need, and keep your phone's software updated.
  • Hotel and airport Wi-Fi bring their own risks. See our public Wi-Fi guide.

Key takeaways

  • In tests published in October 2026, only 27.9% of 172 travel eSIMs used operators in the advertised country; about 40% used networks of Chinese state-owned groups.
  • Roaming can send your data through a third country, giving you a foreign IP address and exposing metadata to another operator.
  • Resellers can have more access than most buyers realise.
  • Choose transparent providers, check your IP, use HTTPS and, if you want, a VPN you trust.