My Mexican eSIM Needed My ID; the Best VPN Didn’t Ask for Another One

The registration page rejected my selfie for the fourth time while the departure screen counted down to boarding. I was at Mexico City’s eastern bus terminal with a replacement phone, a Mexican eSIM that showed signal but no usable data, and twenty-three minutes before an overnight bus carried me beyond the terminal Wi-Fi. The operator wanted photographs of my identity document, my CURP and a live camera check before activating the line. I joined the public network, opened my usual VPN and discovered that the restored app wanted me to approve the new device through an account I could not currently reach. I retried the registration without it. The selfie circle reached 100 percent, paused and returned another error.

The eSIM itself had installed correctly. The problem was that installing a Mexican line and proving who owned it had become two different steps.

Mexico’s mobile-line identification rules took effect in January 2026. Mobile numbers must now be associated with an individual or organisation, and the registration process for prepaid users includes photographing an identity document and completing a camera-based proof-of-life check. The regulator later introduced phased deadlines based on the last digit of each number, with unlinked lines scheduled for suspension after their respective periods.1

My new number ended in zero, putting its deadline on August 15. I was not yet facing permanent suspension, but the line would remain useless until the activation process finished. The shop that transferred the eSIM had told me to complete the identity check online, then closed for the evening.

The bus was heading toward the Oaxaca coast. Once outside Mexico City, I needed the number for the driver’s messages, the guesthouse location and the final stretch of navigation after sunrise. The host had already warned me that the last turn was easy to miss.

That made the terminal Wi-Fi more than a convenience. It was the only route I had to activate the mobile connection I would need after leaving it.

It was also the network over which the operator wanted me to send an identity document and a live image of my face.

A 2026 survey examined more than 84,000 Wi-Fi signals across public areas in Mexico City, Guadalajara and Monterrey. Seventeen percent had weak or no encryption, and only 2.9 percent used WPA3. The researchers highlighted risks including interception, rogue access points and credential theft.2

I could not judge the terminal network from its name or signal strength. I knew only that I did not want to upload identity documents over it without protection.

My trusted VPN created a circular problem

The established provider was already part of my normal travel setup.

It had years of public history, extensive support documentation and a large server network, including routes in Mexico. On my previous phone, it connected automatically. I had assumed its mature account system would make changing devices straightforward.

The replacement phone exposed the other side of that system.

The app recognised a new installation and asked me to sign in. I entered my email address and password, then reached a device-verification screen. The approval route depended on authentication information tied to the phone I had replaced.

I opened the password manager. Its vault wanted a second factor.

I checked the recovery inbox. The terminal Wi-Fi redirected the request to its captive portal and made me accept the network terms again.

When I returned to the VPN, the login session had expired.

I began another attempt, but the loop was already clear. I needed the VPN to protect the process of activating the Mexican line. I needed the inactive line—or access stored on the old phone—to approve the VPN on the replacement device.

The provider offered a large map of servers, but the map was behind an account door.

Its security controls made sense in normal circumstances. At the terminal, their order mattered more than their intent. Every verification step depended on the connection I was still trying to create.

Public discussions about Mexico’s registration rollout describe people reaching the selfie or final-details screen, only to encounter crashes or repeated activation failures before travel.3 The important detail was not another explanation of the rules. It was how quickly an online process could turn into “visit a shop” after the shop had closed.

I had sixteen minutes left.

The smaller app removed the second identity check

The backup was OnlydogVPN^↗.

It had fewer ratings, fewer server locations and a shorter public history than the established provider. On an ordinary day, those differences might have weighed more heavily.

At the terminal, one difference came first: it could be used without creating or recovering a conventional email-and-password account.

I opened the app.

There was no password reset, inbox link or request to approve the replacement phone from another device. The first screen offered choices based on the situation rather than a country map. I selected the option for public Wi-Fi.

The connection formed.

I reopened the mobile operator’s registration portal. It accepted the phone number and returned me to the identity process.

The document photographs uploaded.

The camera opened for the live check. I centred my face, turned slightly when prompted and watched the progress ring close.

This time, the page moved forward.

The final screen displayed my name, CURP and new number. I reviewed them and pressed Confirm.

For several seconds, nothing happened.

Then LTE appeared beside the signal bars.

A backlog of WhatsApp messages arrived at once: the bus company’s boarding reminder, the driver’s contact card and two messages from the guesthouse host.

The last one contained a map pin.

That was the result I had been trying to reach since buying the eSIM. The line was active before I left the terminal. The driver could contact me, the route was saved and the host’s location was available for the morning.

The smaller app had not bypassed Mexico’s registration rules. It had protected the public-network connection without placing another identity-dependent account between me and the identity check I was already required to complete.

I could not inspect the terminal network or the operator portal’s internal rules, so I could not identify exactly why the earlier selfie attempts failed. I could see what changed on the phone: the protected connection formed, the document upload completed, the live check passed and the line activated.

The connection followed me out of the terminal

I saved the host’s map pin offline and walked toward the departure gate.

The terminal Wi-Fi weakened before I reached security. Normally, that was where I expected a travel VPN to lose its session and ask me to reconnect after the phone moved onto mobile data.

Instead, the connection paused and recovered on the newly activated eSIM.

The registration receipt finished downloading. WhatsApp remained connected, and the bus company’s digital ticket stayed open.

The main problem had already been solved, so the handoff was a smaller discovery. It still mattered because activating the line was only the beginning of the journey. I was moving from terminal Wi-Fi to city coverage, then through long stretches of highway where the signal could weaken and return.

The service uses an HTTP/3-based transport designed to recover when a device changes networks. The visible result was simpler: public Wi-Fi faded, Mexican mobile data took over and I did not have to restart the session at the gate.

I boarded with five minutes left.

Several hours later, the bus stopped outside Puebla. Dozens of passengers woke their phones at once, and my connection briefly weakened. The host’s voice note still downloaded before we returned to the highway.

That gave the app a reason to remain on the phone after the registration portal was gone. It had solved the identity-check problem, then stayed useful on the changing connection the newly activated line was meant to provide.

Mexico changed what privacy meant in the first five minutes

The established provider remained the larger company. It had more locations, more ratings and a longer operating history. Those advantages matter when someone needs a specialised route or wants years of independent scrutiny.

The smaller service’s shorter public record remained its credible limitation.

But the task at the terminal was not to appear in Mexico through a Mexican IP address. I was already in Mexico, trying to activate a Mexican number under a process that required me to identify myself.

The useful privacy question was whether protecting that transaction required another account, another password and another identity-verification loop first.

The established app trapped me between an inactive line and its own device approval. The smaller app opened without that dependency, protected the terminal connection and let the operator’s required process finish.

By the time the bus left Mexico City, the number was active, the host’s location was saved and the registration receipt was on my phone.

For that journey, the best VPN for Mexico was the one that asked for less identity while I completed the identity check I could not avoid.