WhatsApp, Telegram face new SIM-binding rules from January 1

Millions of WhatsApp, Telegram and other messaging app users in India could face changes in how they access their accounts from January 1, 2027, as the Centre prepares to enforce new SIM-binding requirements aimed at preventing cyber fraud, impersonation and the misuse of Indian mobile numbers. The Department of Telecommunications (DoT) has set December 31, 2026, as the deadline for messaging platforms to comply with the directions, which require accounts to remain linked to the active SIM card associated with the registered mobile number.

The move could particularly affect users who operate messaging applications on phones without their registered SIM cards, frequently switch devices or rely on secondary smartphones for communication. However, the government has not announced a blanket shutdown of WhatsApp or Telegram accounts from January 1. The precise impact will depend on how individual platforms implement the verification requirements.

𝗪𝗵𝗮𝘁 𝗶𝘀 𝗦𝗜𝗠 𝗯𝗶𝗻𝗱𝗶𝗻𝗴?

SIM binding is a security mechanism that links a messaging account to the SIM card associated with the mobile number used for registration. Currently, applications such as WhatsApp generally verify a user's phone number through a one-time password during account setup. Once verification is completed, users can often continue accessing their accounts over Wi-Fi even if the registered SIM is removed from the device.

Under the new framework, one-time verification will no longer be sufficient. Messaging platforms will be required to maintain an ongoing connection between the account and the active SIM installed in the device.

For instance, a user who registers WhatsApp using an Indian mobile number and subsequently removes that SIM card may face restrictions on accessing the application. Simply connecting the smartphone to Wi-Fi may not be enough to continue using the account.

The requirement can also apply to eSIM connections, which provide mobile network access without a removable physical SIM card. The central condition is that the registered mobile connection must remain active and associated with the device running the application.

𝗪𝗵𝗶𝗰𝗵 𝗮𝗽𝗽𝘀 𝗮𝗿𝗲 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱?

The DoT issued its original directions on November 28, 2025, under the Telecom Cyber Security Rules, 2024. The communication identified eight app-based services that use Indian mobile numbers for customer identification or service delivery.

These included WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat. However, subsequent reports indicate that Snapchat may be exempted from the requirements, although the government's original notification included the platform.

The rules are particularly significant for WhatsApp, which has an estimated 500 million users in India. Reports also indicate that the platform has begun testing SIM-binding functionality on Android devices ahead of the compliance deadline.

The requirements do not mean that the named applications are being banned. Instead, the platforms must introduce technical measures to verify that accounts remain associated with the registered SIM.

𝗪𝗵𝘆 𝗶𝘀 𝘁𝗵𝗲 𝗴𝗼𝘃𝗲𝗿𝗻𝗺𝗲𝗻𝘁 𝗶𝗻𝘁𝗿𝗼𝗱𝘂𝗰𝗶𝗻𝗴 𝘁𝗵𝗲 𝗿𝘂𝗹𝗲𝘀?

The government maintains that the existing system creates opportunities for cybercriminals to misuse Indian mobile numbers. Fraudsters can obtain SIM cards, register accounts on messaging platforms and subsequently operate those accounts from other devices or countries without retaining access to the original SIM.

According to the DoT, such practices have been associated with phishing, impersonation, fraudulent investment schemes, loan scams and so-called digital arrest frauds, in which criminals impersonate police officers or government authorities to extort money from victims.

The ministry has said cyber-fraud losses in India exceeded Rs 22,800 crore in 2024, underlining the scale of the problem. It argues that continuously linking messaging accounts to active, verified SIM cards would make fraudulent operations more difficult and improve the traceability of mobile numbers used in criminal activities.

The government has compared the proposed system with device-binding security mechanisms already used by banking and Unified Payments Interface applications.

However, technology policy experts have questioned whether SIM binding alone can effectively prevent sophisticated fraud, particularly when criminals can exploit other methods of obtaining verified accounts.

𝗪𝗵𝗮𝘁 𝗰𝗵𝗮𝗻𝗴𝗲𝘀 𝗳𝗼𝗿 𝘄𝗲𝗯 𝘂𝘀𝗲𝗿𝘀?

The new framework also addresses messaging services accessed through computers and web browsers. Under the original directions, platforms were required to automatically log users out of web sessions every six hours, forcing them to authenticate again using the registered device.

However, the government subsequently revised this requirement.

In a written reply to Parliament in April 2026, Minister of State for Communications Pemmasani Chandra Sekhar clarified that web sessions would be logged out on the basis of risk assessment rather than a fixed six-hour interval.

This means users of WhatsApp Web, Telegram Web and similar services will not necessarily be disconnected every six hours. Platforms will instead be expected to introduce risk-based authentication measures designed to prevent unauthorised access and misuse of remotely operated accounts.

The distinction is important for professionals, businesses and other users who rely on desktop messaging throughout the working day.

𝗪𝗶𝗹𝗹 𝘁𝗵𝗲 𝗿𝘂𝗹𝗲𝘀 𝗮𝗳𝗳𝗲𝗰𝘁 𝗳𝗼𝗿𝗲𝗶𝗴𝗻 𝘁𝗿𝗮𝘃𝗲𝗹?

International travellers who temporarily replace their Indian SIM cards with local connections could face difficulties if their messaging accounts are no longer linked to the registered number.

However, the DoT has clarified that the directions do not affect users who retain their registered SIM cards in their handsets while roaming internationally.

Travellers using dual-SIM smartphones may therefore be able to retain their Indian SIM while accessing mobile data through a foreign SIM or eSIM. The actual requirements will depend on the verification mechanism introduced by each messaging platform.

Users who operate accounts on secondary phones without the registered SIM may also need to adjust their arrangements. The rules could affect people who regularly move SIM cards between devices or continue using messaging accounts linked to inactive numbers.

𝗪𝗵𝗮𝘁 𝘀𝗵𝗼𝘂𝗹𝗱 𝘂𝘀𝗲𝗿𝘀 𝗱𝗼?

Users are advised to check which mobile numbers are registered with their messaging applications and ensure that the corresponding SIM connections remain active.

Those who frequently switch devices should monitor announcements from their messaging platforms regarding any new verification requirements. Users relying on secondary smartphones or Wi-Fi-only devices may also need to review how their accounts are linked.

There is no indication that users must immediately replace their SIM cards or obtain new mobile numbers solely because of the upcoming requirements.

The government has provided messaging platforms until December 31 to complete the necessary technical changes, following an extension of the original compliance timeline.

The implementation is expected to begin from January 1, 2027, although the experience may differ between applications as companies introduce and refine their verification systems.

The proposed changes represent a significant shift in India's approach to securing app-based communications. While the government expects continuous SIM verification to make online fraud more difficult, the coming months will determine how effectively the requirements can be implemented without unnecessarily disrupting legitimate users.