WhatsApp and Telegram face SIM binding mandate in India to halt cyber fraud

India is rolling out mandatory SIM binding for major messaging services, closing an authentication gap that overseas syndicates and cybercriminals have long exploited to conduct large-scale fraud using Indian phone numbers.

Under guidelines issued by the Department of Telecommunications (DoT) under the Telecom Cyber Security Rules, messaging platforms including WhatsApp, Telegram, Signal, and ShareChat must ensure that a user’s account remains continuously linked to the physical SIM card or registered eSIM installed in their handset. The government has set a compliance deadline of 31 December, with the operational framework taking effect on 1 January.

Once enforced, removing, deactivating, or swapping a registered SIM card will render the messaging application inactive on that handset until the legitimate card is restored.

Why the government is enforcing SIM binding

Until now, messaging platforms verified phone numbers just once through an SMS-based one-time password during initial setup. Once registered, accounts could remain operational indefinitely across Wi-Fi networks even if the underlying SIM was deactivated, discarded, or exported abroad.

The Ministry of Communications said criminals systematically exploit that loophole to run remote extortion networks and impersonate government officials in so-called digital arrest scams. Cyber fraud drained more than ₹22,800 crore from the country last year alone. By anchoring accounts directly to verified SIM hardware, the DoT aims to restore traceability, protect public trust, and secure the national digital ecosystem.

Industry adjustments and user impact

To ensure legitimate users experience minimal inconvenience while security is heightened, the government modified earlier draft restrictions. An initial proposal to forcibly terminate web sessions every six hours was dropped in favour of risk-based session logouts, allowing regular users to keep their desktop sessions active unless suspicious activity is detected.

Device manufacturers and software developers have already moved to support the security architecture. Apple issued an iOS software patch designed to verify when a handset operates without a SIM, while WhatsApp has begun beta testing SIM-binding mechanisms on Android devices. In parallel, the DoT plans to launch a dedicated Mobile Number Verification platform to validate telecom identifiers across services.

For most smartphone owners in India, who keep their regular phone number active on their primary handset, daily messaging will continue without disruption. Handsets running messaging apps purely over Wi-Fi without an active SIM, or users who swap out cards during international travel, will need to retain access to their registered SIM cards to keep messaging services functioning.