Risks of lending/borrowing a SIM card temporarily?

Question

Suppose someone asks to borrow my SIM card so they can e.g. check if their phone is unlocked. I watch them use the phone to check what they need to check, and afterwards take my SIM card back. Is there any risk to me, my data, or my mobile subscription from lending my card like this? For example, is it conceivable that they could "clone" my SIM card in this time and then become capable of permanently receiving my messages or calls?

Conversely, if I borrow someone else's SIM card for a brief period, can their SIM card damage my phone or steal data from it?

On both counts, I suspect the risks are low, but I do not know for sure. For example, I don't know what the effects of an electrically-damaged SIM card might be.

Answer 1

Yes, you can clone a SIM card. All you need is a SIM writer, a blank SIM, and roughly 15-30 minutes. (guide for v2 cards)

Once that happens, they've effectively become your phone, and can intercept communications and messages, and charge your phone plan.

I do not know of any "rogue SIM card attacks," most attackers focus on attacking the SIM cards themselves.

Answer 2

IF someone asks to borrow my SIM card, am I vulnerable? YES

The analogy

Your sim card is like your social security number for your cell phone. Lending that to someone is the same as giving them your social. Now they have your information, you identity on the cell network, and can rack up charges by impersonating you. Worse yet they can even intercept your data.

The reason

A sim card, like any other storage medium can be recreated 1 for 1. That means for literally all purposes it is YOUR sim card. This means that they now have access to your entire cell data history, allotment, settings, calls, texts, everything.

---

If I borrow someone else SIM card, am I vulnerable? ... Maybe?

What do you mean maybe?

Well... really it's more like yes. A SIM card is usually a storage medium, but if it looks like a SIM, talks like a SIM, but isn't a SIM then it's a possible attack vector. These devices can send any data/commands sent to them out, and can send commands and other things to your phone in a way that could cause problems if a vulnerability exists.

What about if I trust the person who owns the SIM card?

To... what? Trusting someone who isn't you in security matters is like saying "You look like I think you should, here have a copy of my social security number." That sounds a little dangerous to more than just me. This is why I said maybe. If you "know" they are trustworthy and are willing to risk it, who are we to stop you?
I still would never do this. If I need to check my device, I would go to a dealer that is trusted, or a service center that is trusted. Those people have life impacting incentives to make sure they keep trusted and on the up and up.