India Mandates SIM Binding for Messaging Apps to Curb Fraud

The Department of Telecommunications of India has mandated that messaging and calling applications implement SIM binding to combat phishing, investment fraud, and digital arrest scams. Under the Telecom Cyber Security Rules 2024, apps must ensure that a user's account remains linked to a KYC-verified physical SIM or eSIM present on the device. A registered phone number alone will no longer suffice for access if the SIM is missing or inactive.

Platforms must comply by December 31, 2026, with enforcement beginning January 1, 2027. Affected services include WhatsApp, Telegram, Signal, Snapchat, ShareChat, Arattai, JioChat, and Josh. The measure specifically targets cybercriminals operating from outside India who use Indian mobile numbers without possessing the physical SIM. While Apple has already patched iOS to detect missing SIMs, Signal has reportedly not yet responded to government notices.

The mandate may disrupt service for users on tablets, Wi-Fi-only devices, or secondary phones. Additionally, the agency replaced a previous requirement for mandatory six-hour web session logouts with a risk-based system that allows for the immediate termination of services in suspected fraud cases.