Improved techniques are provided for security management in communication systems particularly with respect to access to restricted local operator services in the case of roaming user devices. In one example in accordance with user equipment in a communication system, a method includes initiating a request for access to restricted local operator services, acquiring a network identifier comprising a first country code, and comparing the acquired network identifier with a stored network identifier comprising a second country code. A determination is made whether the first country code and the second country code are different. At least a first action is performed in response to an affirmative determination, and at least a second action is performed in response to a negative determination.