Designing against fraud
Making eSIMs safer
PROJECT
Snapshot
Company: BT Group / EE
timeline: July 2025 - August 2026
role: Product Designer
SCOPE:
Product Design · UX/UI · Information Architecture
Prototyping · Security Integration · Delivery
collaborators: Product, Engineering, Content Design, Research, Fraud, Cybersecurity, Identity, Legal & Onfido
overview
Our eSIM service had two main issues:
01: Customers were dropping out
Downloading and activating an eSIM existed as separate journeys. Many customers believed their eSIM was ready after downloading it, leaving setup incomplete and creating avoidable support demand.
02: eSIM fraud needed to be stopped
The existing One Time PIN (OTP) verification model was being exploited. Fraudsters could intercept or socially engineer OTPs during eSIM replacement, enabling account takeover and fraudulent activity.
EE also wanted to increase eSIM adoption, reducing our reliance on physical SIMs and the costs that come with them. I was responsible for redesigning the experience across app and web, while introducing eKYC to make the journey more secure without adding unnecessary friction.
IMPACT
& Metrics
The measurable impact of strengthening eSIM security while improving the experience for legitimate customers.
42%
Reduction in security related calls, elevating support centre demand.
📞
📊
+
21%
DCR improvement
90%
Reduction in eSIM fraud across app & web.
➜
0
Fraudulent eSIM replacement swaps
Down from an average of 11 per day
🛡️
💸
£50k
Saved per week
🔀
64.6%
Web & app conversion
UNDERSTANDING
the Landscape
I inherited the existing SIM journeys, so before uplifting experience, I needed to understand what customers were actually seeing live across app and web.
As a legacy journey, documentation was limited & outdated, so they didn't completely reflect the current experience. I audited the live journeys against existing design artefacts to build an accurate view of how eSIM download, activation and replacement worked.
Diagnosing the problem
I reconstructed each live journey screen-by-screen, annotating design opportunities, technical issues and questions that needed further investigation.
I combined this audit with customer feedback, contact-centre insights and known backend issues to build a clearer picture of where the experience was breaking down and where I needed input from other teams before defining a solution.
Example of one section of the audit.
I translated the audit into concerns, potential solutions and questions.
This turned my complex sets of journey issues into action pieces. This allowed me to identify what I could progress through design, what needed technical validation, and what required further stakeholder input.
DIAGNOSIS
to Direction
With the key issues identified, we mapped the proposed journey at an architectural level and worked with Engineering, Business Analysis and QA to validate what was technically feasible.
This exposed a bigger opportunity: rather than improving Download and Activation as separate journeys, they could be redesigned around the customer's actual goal: getting their eSIM working.
Mapping the proposed journey across key paths, dependencies and edge cases.
Before: Two disconnected journeys
Step 1: Download eSIM
Customers downloaded their eSIM and were returned to the Dashboard, despite activation still being required.
➔
Step 2: Activate eSIM
Customers had to return to Settings themselves, find Activate eSIM, verify via OTP and complete activation seperately.
The experience signalled success to early.
With no clear handoff to Activation, customers could reasonably assume their eSIM was ready to use, only discovering it wasn't when their service failed. This contributed to complaints, increased contact-centre demand and poor DCSAT.
After: One shorter, continuous journey
Verify Identity
Confirmation, Download & Activation in one step
Download/Activation
Completion
Customers could verify their identity, download and activate their eSIM in one continuous flow, only reaching completion once their eSIM was ready to use.
INTERGRATING
Security
SIM replacement is a high-risk point for fraud, so the new experience required stronger identity verification. We introduced eKYC through EE ID, using Onfido to verify a customer's identity against legal documentation and biometrics.
While eKYC gave us stronger fraud protection, we needed to introduce this additional security without making legitimate customers feel blocked or confused. Working closely with EE Identity, we focused on three questions to shape the experience and content:
🤔
Why am I being asked to verify myself?
Explain why additional security is needed.
🪪
What will I need?
Prepare customers before verification begins.
📱
What happens when I leave the app?
Set expectations for the handoff into EE Identity / Onfido.
Testing the experience
We tested the integrated journey with customers to ensure the new verification step felt clear and trustworthy. We also did it to identify where additional context and reassurance were needed before finalising the experience.
Security, integrated into the journey
01: Introduce verification
Explain why it's needed and what happens next.
02: Prepare customers
Set expectations for ID and facial verification.
03: Verify identity
Complete document and biometric checks through Onfido.
04: Return & continue
Rejoin the eSIM journey to download + activate.
This project gave me the opportunity to work much more closely with cybersecurity, and challenged me to balance teams with fundamentally different priorities:
Fraud needed stronger protection, Legal needed transparency & compliance, Engineering needed technically feasible flows, Product needed conversion and customers needed less friction.
The result was an experience that made eSIM safer for our customers, significantly reduced fraud and delivered meaningful savings for the business.
It’s been one of the most technically complex projects I’ve worked on, and I’m excited to bring that experience to my next challenge.
Desola
senior product designer