If the phone would be stolen then the SIM card will be thrown out by thieves just after the theft so that they can't be found.
If the phone would be lost then it will be harder to find an owner for people that found it if the SIM is protected with PIN.

So is there any reason to protect SIM card with PIN?

5 Answers 5


When SIMs were introduced, the purpose was to contain the user's identification for the sake of the mobile network. The small, relatively cheap physical objects were a convenient way of deploying subscriber identities separately from the bulky, expensive phone that may or may not have been supplied by the network operator. (Hence the name subscriber identity module.) The primary asset on the SIM is the identity of the user (in his role as subscriber to the mobile phone service); a secondary asset is the cryptographic key that protects it. See Security Engineering by Ross Anderson, §20.3.2 (§17.3.3 in the first edition).

You'll note that this is an asset of the network operator. The user has little incentive in protecting his identity. In practice, the loss of this asset means that the phone has been stolen. The loss of the phone is usually a higher cost than the possible loss of communication credit to the thief.

Over time, phones started to have more and more features. In particular, on basic mobile phones, the SIM tends to contain private data such as an address book. This private data is an asset of the user. With the move towards feature phones and smartphones, the private data escaped the SIM, which went back to containing little more than the subscriber's identity.

When you boot a basic phone, you're typically prompted to enter a 4-digit code. That's authentication for the SIM: basic phones tend not to have any authentication. When you boot a smartphone, it prompts you for its own authentication, and most users don't bother with a SIM PIN on top. I don't have figures, but I believe that most people do have one PIN (or other authentication factor such as gestures) for their mobile device, either for the SIM or for the phone. Miraculously (well, it's partly by design), the authentication or lack thereof correlates with the value of the assets to the user.

Access to the SIM allows the thief to impersonate the user, but only for a limited time, until it is reported stolen. If the thief has an unlocked SIM, he can access the user's voicemail and SMS history. This is a reason to protect your SIM even in a smartphone, but a weak one for most people: mobile phone theft is predominantly about the value of the phone, also more and more about leveraging smartphone data, but rarely targeted at the victim's private information. If you're likely to be targeted for your private data (say, if you regularly negociate multimillion deals on your phone), you'd better protect your SIM.

An unprotected SIM allows the thief to make phone calls without paying, and most importantly, anonymously. There are two main ways to make anonymous mobile phone calls: with a stolen SIM, if the thief isn't caught; and with a prepaid SIM, if it is bought anonymously (typically for cash or with a stolen credit card). A stolen SIM is inconvenient for that purpose in that it has a limited useful life (only until the SIM is blacklisted, which the operator can do). If the stolen SIM can go undetected for long enough to be fenced, it is much more valuable, as it makes the link between the SIM and the thief hard to trace.

If the thief uses the SIM, his approximate location becomes known. This is rarely a concern. The location of the theft is broadly known anyway. The identity of the thief is not known a priori; what is valuable is “where was criminal X at time T?”, not “where was the thief of this SIM at time T?”. The thief location is only useful if you can correlate the stolen SIM with the criminal in the first place. In practice, the phone is more likely to be traced than the SIM (both are equally traceable by the operator or law enforcement).

Note: this answer assumes that the thief is unable to guess or bypass the SIM PIN. This is a realistic assumption in most situations, as the SIM will lock after 3 invalid guesses, and the cost of breaking the SIM is typically higher than the assets.

  • 2
    I would like to make a (slightly irrelevant point) that in my country, Singapore, you are required by law to prove your identity before purchasing a prepaid sim card.
    – user10211
    Aug 20, 2012 at 2:10
  • 2
    This is only valid if a phone is lost or stolen while switched off. I usually have entire months or even years when I don't have to enter the PIN because my phone is never turned off. I think most people don't carry phones around while they are switched off or have empty batteries.
    – vsz
    Aug 20, 2012 at 6:09
  • 1
    @vsz On most phones, you have an option that will prompt the PIN login everytime it's been locked.
    – Kao
    Aug 20, 2012 at 8:29
  • I used to scan long answers to spot the TL;DR part... don't tell me I'm the only one.
    – elsadek
    Aug 23, 2017 at 23:04
  • What about the 2FA case when the phone is especially stolen to get the SIM card, which if unlocked is usually the fallback method for many 2FA systems. Or in case of banks, many times the primary method even. Would PIN protection work in this case?
    – hyperknot
    Dec 18, 2019 at 17:22

I think there is.

Stolen phones can also be found by their IMEI, the devices ID. But it's probably too much effort for law enforcement.

Same goes for SIMs... Most people will simply get a new SIM instead of waiting for somebody to find and return it to them.

On the other hand, if somebody steals your SIM, they could use it to impersonate you. They could write text messages from your number, they could receive mobile TANs (e-banking authorization codes) and much more. So there are some reasons for using a PIN.

  • How are TANs and the like a concern? If the phone is stolen with the SIM unlocked, the presence of a PIN is irrelevant. If the thief is in a situation where he may need to unlock the SIM, it's likely that the user wasn't actively using his phone at the time of the theft, so the thief would only have access to stale one-time credentials. Aug 20, 2012 at 0:15
  • 1
    If you're on contract, they could use your SIM to run up a massive bill with app purchases and premium rate calls. Wouldn't be much fun to get landed with that.
    – Polynomial
    Aug 20, 2012 at 5:58
  • @Gilles: but the phone could be locked. Aug 20, 2012 at 11:34
  • 1
    @Gilles PIN-protecting the SIM would prevent someone from using the SIM by just putting it in another phone. I think it is assumed that the phone it was originally residing in is itself configured to be secure (e.g., the phone itself would be PIN-protected and configured not to display notifications on the lock screen). An unlocked SIM (the common case) would allow the thief to place the SIM into a phone they control and log into services which, e.g., only use SMS for authentication and impersonate the user or allow SMS-based account recovery.
    – binki
    Nov 28, 2017 at 23:37

SIM can contain many things. For example your contacts, personalisation settings etc.

So the first use of the PIN is to protect your private life. Moreover, being able to use a SIM with no PIN makes a thief able to use your mobile subscription: make illicit calls, charge you with mobile services or use the phone for some other illegal activity that could incriminate you. Impersonation can also take place, leading to bigger problems: identity theft, social engineering etc.

Anyway, as you would keep your credit card PIN secret and active, or you wouldn't give anyone your address and your keys: keep your SIM protected with a good PIN. Do NOT use a too simple password!


Thieves are stealing phones now, not for the value of the phone, but because before it's reported lost or stolen they're dialling premium rate numbers which they control. They get a share of the revenue from dialling the numbers so they steal the phone, transfer the SIM to another phone and then call the premium rate number. The original owner of the phone is then landed with a bill for the calls made until the SIM is blocked.

A recent story in the UK media was about a person who's phone was stolen and the thief ran up a £15,000 bill by transferring the SIM into another phone.

That's why it's a good idea to SIM lock.


Nowadays the SIM cards hold less personal info than they used to hold; smartphones don't store contacts in the SIM anymore, SMS messages are immediately copied to the smartphone's memory and erased from the SIM, so in the end the only personal thing that's left is the phone number itself, it can still be used for social engineering, calling premium rate numbers or receiving 2-factor authentication tokens.

However, the big downside of a SIM PIN is that smartphones don't remember it and prompt you each time they reboot (there's no technical reason preventing this, the phone can remember the SIM's ICCID + PIN and automatically unlock it each time it boots if the ICCID matches the registered card's one), so now think about what happens if your phone is stolen, has a passcode and you use Find My (i)Phone to track it... great, you can get it back ! Now what if the thief reboots the phone or it runs out of battery... the phone's passcode prevents the thief from even attempting to enter a PIN once the phone is powered back on, without that there's no more data connection and you can no longer track the phone.

  • So Apple needs to implement an “auto-erase if no internet for 2 days” option or something ;-).
    – binki
    Nov 28, 2017 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .