A SIM card (subscriber identity module) is a removable smart card that holds the subscriber identity and the secret authentication key a mobile network uses to recognize, authenticate and bill a subscription. In telecommunications, it separates the identity of the subscription from the handset, so the same line can move between devices simply by moving the card.
Within the SIM & eSIM topic, the physical SIM card is the reference point against which newer forms are measured. An eSIM profile carries the same credentials on a soldered chip, and iSIM moves them into the main processor, but the security model and the network procedures remain those first defined for the plastic card.
How a SIM card authenticates a subscriber
A SIM card authenticates a subscriber through a challenge-response exchange in which the secret key never leaves the card. The card stores the IMSI, which identifies the subscription, and a 128-bit key called Ki, which is also held in the operator’s authentication center. When the phone attaches to the network, it presents the IMSI or a temporary identifier, and the network replies with a random challenge.
The card’s processor combines the challenge with Ki using the operator’s chosen algorithm, such as MILENAGE or TUAK in 3G, 4G and 5G networks, and returns a response together with session keys for encryption and integrity protection. Because the network computes the same values independently, a match proves that the card is genuine. Since 3G, the exchange is mutual authentication: the card also verifies a token from the network, which blocks simple fake base stations.
Technically, the card is a Universal Integrated Circuit Card (UICC) running one or more applications. The USIM application handles 3G, 4G and 5G access, while an ISIM application may serve IMS services such as voice over LTE. The card also stores network lists, the PIN and PUK codes, and small amounts of user data.
The following table lists the main data elements stored on a SIM card and their purpose.
| Data element | What it is | Purpose |
|---|---|---|
| ICCID | Serial number of the card, up to 20 digits | Identifies the physical card in logistics and activation |
| IMSI | Subscriber identity, up to 15 digits | Identifies the subscription to the network |
| Ki | 128-bit secret key, sometimes 256-bit | Basis of authentication and session keys |
| PIN and PUK | 4-8 digit PIN, 8-digit unlock code | Protects the card against unauthorized use |
| Network lists | Preferred and forbidden network codes | Guides network selection and roaming |
SIM card form factors and their dimensions
SIM card form factors differ only in plastic size; the chip and its contacts follow the same ISO/IEC 7816 interface. Over three decades the card shrank from credit-card size to nano-SIM, which is now the standard in smartphones. Many operators ship a single triple-cut card that can be pressed out to mini, micro or nano size.
| Form factor | Dimensions | Typical use |
|---|---|---|
| Full-size (1FF) | 85.6 x 54 mm | Early mobile phones, now obsolete |
| Mini-SIM (2FF) | 25 x 15 mm | Feature phones, older modems, some IoT devices |
| Micro-SIM (3FF) | 15 x 12 mm | Smartphones and tablets of the early 2010s |
| Nano-SIM (4FF) | 12.3 x 8.8 mm, about 0.67 mm thick | Current smartphones and tablets |
| MFF2 embedded | 5 x 6 mm soldered package | Industrial IoT, vehicles, eSIM hardware |
Beyond size, cards vary by temperature grade and endurance. Consumer cards are rated for ordinary indoor use, whereas industrial-grade SIMs tolerate roughly -40 to +105 degrees Celsius, vibration and many more write cycles, which matters in vehicles, meters and outdoor sensors.
SIM card compared with eSIM and iSIM
The SIM card, eSIM and iSIM share the same authentication principles but differ in where the credentials live and how they are loaded. With a physical card, the operator writes the profile at the factory and the user receives it by mail or in a shop. With an eSIM, an operator profile is downloaded remotely to a secure element under the GSMA remote SIM provisioning specifications.
| Aspect | Physical SIM card | eSIM | iSIM |
|---|---|---|---|
| Where credentials live | Removable plastic card | Soldered secure chip | Secure enclave inside the processor |
| How a line is added | Insert the card | Download a profile | Download a profile |
| Switching devices | Move the card by hand | Transfer or re-download the profile | Transfer or re-download the profile |
| Board space | Tray and connector needed | Small package | No separate component |
| Theft or tampering | Card can be removed | Cannot be removed | Cannot be removed |
The SIM card should also not be confused with the IMEI, which identifies the handset rather than the subscription. Moving a SIM card to another phone keeps the IMSI and phone number but presents a different IMEI to the network, which is why stolen-phone blacklists work on IMEI numbers. Dual SIM phones combine two subscriptions, often one physical card and one eSIM.
Practical choices when using a SIM card
A physical SIM card remains the practical choice when a device lacks eSIM support, when a line must move often between devices, or when travel SIMs are bought locally. In other cases an eSIM is more convenient. The decision table below summarizes typical situations.
| Situation | Recommended option | Reason |
|---|---|---|
| Older or low-cost phone | Physical SIM card | eSIM hardware may be absent |
| Frequent swaps between devices | Physical SIM card | Swapping a card needs no operator process |
| Short trip abroad | eSIM or local SIM card | eSIM avoids the shop visit; local cards suit eSIM-less phones |
| Phone at risk of theft | eSIM | A thief cannot simply remove the line |
| Fleet of sensors or meters | Industrial SIM or embedded eSIM | Durability and remote management |
Setting a custom SIM PIN protects the line if the phone is lost, because the card refuses service after a restart until the code is entered. Three wrong PIN entries block the card, and ten wrong PUK entries usually disable it permanently, so the PUK from the operator should be stored safely.
Limitations and risks of SIM cards
The main weaknesses of SIM cards are physical fragility and the processes around them rather than the cryptography. The most damaging threat is SIM swap fraud, in which an attacker convinces an operator to transfer a victim’s number to a new card and then intercepts one-time codes sent by text message.
- Old 2G algorithms: early COMP128 versions allowed key extraction; current USIM algorithms are not known to share this weakness.
- Contact wear and corrosion: repeated swapping or humidity can cause intermittent no-SIM errors.
- Lost cards: a card left in a discarded phone still carries the line until it is blocked.
- SIM lock confusion: a carrier-locked phone rejects foreign cards; the lock is in the phone, not in the card.
A practical defense against SIM swapping is an operator account PIN and the use of authenticator apps instead of text-message codes for important accounts.
Understanding it simply
A SIM card is like a membership card for a mobile network. The phone is only the device; the card says which subscription it belongs to and proves that the subscription is genuine.
When the phone is switched on, the network asks the card a question that only a real card can answer correctly. If the answer is right, calls and data work. Put the card in another phone and the number moves with it, because the identity lives on the card, not in the phone.
Applied in practice
A field technician uses an older rugged phone without eSIM support for work at construction sites. When the screen cracks during a shift, the company gives the technician a spare handset of the same model.
The technician opens the tray with a pin, moves the nano-SIM card to the spare phone and enters the four-digit PIN after the restart. Within about a minute the phone registers on the network with the same number, contacts stored on the account sync again, and work calls continue without any operator involvement. The damaged phone goes to repair with no active line inside it.