DoT’s SIM Binding Rules Set to Take Effect Beginning January 1 to Curb Cyber Fraud: Here’s What Changes

The Department of Telecommunications (DoT) has directed messaging and communication apps to comply with SIM-binding rules from January 1, 2027. The compliance directive mandates that such apps implement a SIM-based login verification process in an attempt to keep user accounts linked to the active SIM cards associated with their registered Indian mobile numbers. DoT says the move is aimed at curbing fraud and safeguarding the digital ecosystem. The rules could change how users access services such as WhatsApp, Telegram and Signal on their devices.

SIM-Binding Rules for Messaging Apps

The DoT issued the directions on November 28, 2025, under the Telecom Cyber Security Rules, 2024, with the government making the order public through a Press Information Bureau release on December 1, 2025. The original directions gave covered services 90 days to implement the changes. The compliance deadline was subsequently extended to December 31, 2026, following requests from the industry.

The eight apps named in the original directions are WhatsApp, Telegram, Snapchat, Arattai, ShareChat, Josh, JioChat and Signal. The mandate applies to covered app-based communication services that use an Indian mobile number to identify users or provide their services.

How SIM Binding Will Work for WhatsApp, Telegram and Other Apps

Under the SIM-binding requirement, a messaging app must remain linked to the specific, active SIM card associated with the user's registered Indian mobile number. The app should not function on the device if that SIM is removed or is no longer active. Service providers are also required to implement additional measures, for instance, restricting access to a user's account when their SIM card is removed or changed.

The original directions also included requirements for web-based versions of covered services to log users out periodically and allow them to relink their devices. However, the government later moved away from a blanket six-hour logout requirement for web and desktop sessions, adopting a risk-based approach instead.

Currently, users can continue accessing many messaging apps even after removing the SIM used to register their account. The DoT says this creates an opportunity for fraudsters to misuse accounts and Indian mobile numbers, including when operating from outside the country.

Messaging apps, notably, have already begun to prepare for compliance. WhatsApp has reportedly started working on SIM-binding-related features for users in India to align with the DoT directive. Per a feature tracker, the app will inform users that it must check that their SIM card is present in their smartphone to comply with regulatory requirements.

The government has cited digital-arrest scams, impersonation, phishing, investment fraud and loan-related scams as key concerns behind the mandate. According to the DoT's December 2025 release, cyber-fraud losses in India exceeded Rs. 22,800 crore in 2024. The department has pointed to SIM-linked verification already used by banking and UPI services as a model for strengthening account security.

DoT's SIM binding mandate could affect people who regularly change phones, remove their SIM cards, switch to a different number, or use messaging services while travelling. Users may need to keep their registered SIM active and inserted in the device running the app to maintain access. The rules also raise questions about convenience and privacy, particularly for people who rely on messaging apps across multiple devices.