WhatsApp SIM binding rules: What is it, why is India introducing them and how will users be affected
Imagine you open WhatsApp Web and a message appears saying that the service has stopped because the registered SIM card on your smartphone is no longer present. This might become a reality for Indians from next year. WhatsApp, Telegram, Signal and Snapchat are among the platforms that must comply with India’s SIM-binding rules from January 2027. If we consider the figures for the Meta platform, the move is set to affect over 850 million users in India. While WhatsApp will remain the largest platform, other notable players impacted by the move will include Snapchat and Telegram, with over 250 million and 150 million users, respectively. Beyond these, Arattai, ShareChat, Josh, JioChat and Signal, identified as Telecommunication Identifier User Entities (TIUEs), must comply with India’s SIM-binding guidelines. Moreover, while the government has specified the compliance requirements, the exact technicalities and their impact on people are yet to be fully explained.
Under the Telecom Cyber Security Rules, 2024, these social media apps were directed to ensure that their communication services are offered only when the registered SIM card is present in a user’s device. While the requirement of mandating periodic reauthentication of web services (every six hours) was also part of the initial notification, it was later rolled back and changed to a risk-based approach, ET reported. This implies that the familiar WhatsApp notification experience on PCs will continue even after six hours next year.
In the updated approach, PC sessions will be logged out if fraud is suspected. This could include login attempts from a suspicious location or IP address. However, details on how the procedure will be implemented and how it will affect users of these social media apps remain unclear. To help you make sense of the development, here are the key details and expert opinions.
What is SIM binding?
If you use UPI or banking apps, you are already familiar with a basic version of SIM binding. Simply put, the app pauses the setup process at the login screen if the SIM linked to the phone number is not detected in the smartphone. To proceed, these apps send an SMS to verify whether the SIM is in the handset and is using active mobile data. This process of tying an account to a SIM and pausing activity if it is not detected is a form of SIM binding.
'It is a kind of continuous verification in which the app will keep on confirming the presence of a SIM in the device, either a physical SIM or an eSIM profile. If it finds it, it will remain authenticated. Otherwise, it will stop working,' Techarc founder Faisal Kawoosa said. The Indian government aims to implement a similar approach for popular social media apps to curb evolving forms of cyber fraud. However, experts point out that this may be modified to include a stricter approach than SMS-based authentication. Note that if the government mandates sending the verification request from the registered number, this could require an active outgoing SMS facility. If an approach like that used by UPI apps is followed, WhatsApp accounts may also use the internet from the same SIM during the verification process. 'Many people used to get a prepaid SIM and activate a WhatsApp account for it and would go with the lowest recharge plans. Sometimes they would even forget to recharge or skip it and recharge after a gap. Now they will have to keep their numbers active,' Kawoosa noted.
Why implementation is difficult
Soon after notifying a 90-day deadline to comply with the order in December 2025, the DoT extended the deadline to December 31, 2026. This was mainly due to the 'technical constraints' affecting social media platforms in implementing the measures, a Moneycontrol exclusive reported. The key issue is maintaining the interoperability of social media accounts across smartphones, the web, and other experiences without hampering the user experience, while complying with the guidelines.
Beyond the apps, American giants Google and Apple also sought longer runways to edit their Android and iOS operating systems, respectively, in compliance with the move. To implement 'true' SIM binding, messaging companies must access the IMSI (International Mobile Subscriber Identity) and ICCID (Integrated Circuit Card Identification) unique identifiers of a SIM card. Since mobile companies do not share IMEI, IMSI, and other sensitive data with third parties, this could be a major implementation hurdle, Medianama founder Nikhil Pahwa said. If this is not achieved, the SMS route will primarily be used, along with other periodic authentication methods.
Government on why SIM binding is important
In a press release dated December 1, the Ministry of Communications highlighted the 'issue' of messaging apps allowing people to use their services (after OTP-based verification, which is different from SIM binding) regardless of whether a SIM card is available in their devices. This relaxation was being 'misused' by cybercriminals to commit fraud against the Indian population, even from outside India.
These directions were intended to tackle this 'security gap' that leads to frauds such as digital arrest, impersonation of government officials and other anonymous scams using Indian numbers. The government said that the web versions of these apps were being authenticated once on a device in the country and then operated from outside it. As a result, these OTT apps were being used to commit scams from remote territories, complicating traceability for authorities. The repeated login authentication requirements (reportedly pulled back now) aimed to combat activities such as misuse via remote access, account takeover and mule-account operations. Further, during a Suo Motu hearing on digital arrest scams in the Supreme Court, led by CJI Surya Kant, the Indian government said that SIM binding would help curb digital arrest scams. Moreover, India's Communications Minister Jyotiraditya Scindia noted in February that SIM binding remains the need of the hour.
The move aims to bolster national security and help state agencies track cybercrimes more effectively, Scindia told ET Telecom. The Indian Cybercrime Coordination Centre (I4C) had already warned of a transnational cybercrime operation in which scammers lure WhatsApp users into downloading an '.APK' file after they click on a fraudulent ad. The victim is then asked to scan a QR code in WhatsApp. Once this is done, scammers gain access to their account through the 'Linked devices' feature. The SIM-binding regulations aim to reduce the success rates of these activities.
SIM binding on WhatsApp
Meta’s WhatsApp was spotted developing SIM-linkage functionality in its Android beta in February 2026. WABetaInfo reported that a prompt with the text, 'Due to regulatory requirements in India, WhatsApp needs to check that your SIM is in your device', was spotted in the development build. A similar note might appear when a user enters their number to continue setting up the app starting next year.
Plus, periodic verification requests to check for the presence of the SIM card may be implemented as a compliance measure. This could mean WhatsApp may stop using passkeys and instead deploy six-digit codes to renew account sessions, the report noted. Since this requirement is limited to India, the additional safeguard will apply only to numbers with a '+91' international prefix.
Currently, WhatsApp and most other messaging apps use device binding. If you log in on a new smartphone with an OTP (not through the Linked devices feature), the main session on the old device is automatically logged out. The SIM-binding feature is expected to add another layer to this existing safeguard.
What changes for users
WhatsApp currently allows multiple account logins in a single app. This requirement will limit users to using accounts only on SIM cards that are active on the phone. 'If a user is using WhatsApp on multiple devices, including desktop, and it cannot authenticate within the stipulated time, they won’t be able to use it,' Faisal said. The direction is also set to affect users who use two WhatsApp apps via features like 'dual space' to access more than two WhatsApp accounts on a single phone.
The move is also set to trigger problems for people who use different SIMs during international trips. 'If a person travels internationally and does not have the Indian SIM active in their phone, WhatsApp won’t authenticate. This means anyone travelling abroad will have to keep their number active for international roaming,' the tech analyst added.
From a monetary standpoint, businesses deploy software-based automation and AI tools on WhatsApp to send updates and communicate with customers and clients. 'These messages are not sent by an individual, and there is no SIM card on the device. They are sent almost entirely through a software tool, which may be automated in some cases,' Nikhil Pahwa said. Things might break when SIM binding is enforced, Pahwa warned.
These repeated logins could impact conversational workflows and disrupt the user experience. He raised similar concerns for Telegram, as the platform offers bot-based automated actions that can be operated from remote locations.
SIM Binding: Effectiveness in curbing cybercrimes
Even after deploying SIM binding for a while, UPI and banking apps have not yet achieved significant improvements in fraud prevention against scams. On a similar note, Nikhil expresses a negative view when asked whether SIM binding could make a noticeable difference to scams on these messaging apps. The modus operandi used for digital arrests also involves video-calling services like Skype and Zoom, which allow access to their services without SIM-verification-based logins, he noted. How these will be regulated is a conversation for another day.
While expressing concerns about the measure’s efficacy, he noted that the requirement may be faked using a rooted Android device or a jailbroken iPhone. 'Cybercriminals might find a workaround for SIM binding soon or evolve their methodologies,' he added. 'And lastly, people might be left with nothing, but the inconvenience caused by this regulation.'
Further, a survey from Esya Centre argued that online fraud mainly involves phishing, password leaks, and malware. These are not primarily dependent on SIM binding. However, cybercriminals' evolving strategies 'do not mean we must not act,' Faisal said. He appears positive and claims that SIM binding will curb scams to 'some' extent. 'Fraudsters who used Indian numbers for WhatsApp accounts, while sitting anywhere in the world, to defraud people or plan anti-national activities will no longer be able to use the linked devices trick,' he said.
Unofficial WhatsApp clones could emerge as alternatives
SIM binding could also trigger a wave of logins on unofficial clones, such as 'GB WhatsApp', 'WhatsApp Delta', 'WhatsApp Plus' and more, which are used by cybercriminals and some people for their elevated privileges over the official version. Operators of these unofficial apps could market them as alternatives to bypass SIM-binding requirements. This could lead to scams if unaware citizens start downloading these malicious versions on a larger scale.
Faisal highlights a threefold challenge for platforms due to SIM binding. First, these social media companies design apps with uniform protocols and architecture globally. Now, they will have to build country-specific features and architectures. Second is the cost implication. Imagine millions of Indians sending requests to servers to confirm SIM binding. That will increase the apps' operational costs. The third challenge is allowing these platforms access to low-level hardware identifier information, which is currently limited to mobile OS owners.
While SIM binding could make it harder for cybercriminals to misuse Indian mobile numbers, it may not act as a wonder drug against all forms of digital fraud. Scammers have repeatedly found ways around security measures. Only time will tell if the upcoming measure will be any different. The real test will be to assess whether the additional layer makes digital communication safer without turning messaging into a frustrating experience for millions of legitimate Indian users. All in all, the success of the move will be measured by how many frauds it actually prevents and whether it deflates the reported figure of Rs 22,800+ crore in scam losses.