A method of provisioning a mobile device (115; 200; 512) configured to communicate on a mobile communications network operated by a mobile network operator (320; 530), the method comprising: determining, by the mobile device in communication with the mobile network operator, a data plan for accessing the mobile communications network operated by the mobile network operator; generating, by the mobile device, a temporary eUICC ID, EID, TEID, based on an indicator of a hash algorithm, a nonce, and a hash generated using the hash algorithm, wherein the hash is generated based on the indicator, nonce, and EID of the mobile device; sending, by the mobile device to the mobile network operator, the TEID to identify the mobile device in lieu of using the device's EID, wherein the TEID is stored in a data store and an eSIM profile for the mobile device is associated with the TEID, wherein the eSIM profile is associated with the data plan; receiving, by the mobile device from the mobile network operator, an activation code associated with the eSIM profile, wherein the activation code identifies the eSIM profile to be obtained from the mobile network operator; sending, by the mobile device to an eSIM server of the mobile network operator indicated by the activation code, the device's EID over a secure communications channel; and receiving, by the mobile device via the secure communications channel, subscription credentials of the eSIM for accessing the mobile communications network operated by the mobile network operator in accordance with the data plan, the subscription credentials provided based in part on a verification of the hash contained in the TEID stored in the data store to a hash generated using the indicator and nonce contained in the stored TEID and the device's EID received over the secure communications channel. determining, by the mobile device in communication with the mobile network operator, a data plan for accessing the mobile communications network operated by the mobile network operator; generating, by the mobile device, a temporary eUICC ID, EID, TEID, based on an indicator of a hash algorithm, a nonce, and a hash generated using the hash algorithm, wherein the hash is generated based on the indicator, nonce, and EID of the mobile device; sending, by the mobile device to the mobile network operator, the TEID to identify the mobile device in lieu of using the device's EID, wherein the TEID is stored in a data store and an eSIM profile for the mobile device is associated with the TEID, wherein the eSIM profile is associated with the data plan; receiving, by the mobile device from the mobile network operator, an activation code associated with the eSIM profile, wherein the activation code identifies the eSIM profile to be obtained from the mobile network operator; sending, by the mobile device to an eSIM server of the mobile network operator indicated by the activation code, the device's EID over a secure communications channel; and receiving, by the mobile device via the secure communications channel, subscription credentials of the eSIM for accessing the mobile communications network operated by the mobile network operator in accordance with the data plan, the subscription credentials provided based in part on a verification of the hash contained in the TEID stored in the data store to a hash generated using the indicator and nonce contained in the stored TEID and the device's EID received over the secure communications channel.