Our Bureau
New Delhi
The Department of Telecommunications (DoT) will enforce SIM-binding requirements for messaging platforms, including WhatsApp and Telegram, from January 1, 2027, requiring accounts registered with Indian mobile numbers to remain linked to the corresponding active SIM card in the device. The move aims to curb cyber fraud, phishing, impersonation and scams involving the misuse of Indian mobile numbers.
Messaging platforms have been given until December 31, 2026, to comply with the requirements. Under the framework, users could lose access to their accounts if the registered SIM is removed, deactivated or no longer available in the device running the application.
The directions, issued under the Telecom Cyber Security Rules, 2024, cover services including WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat. The government said the measures are intended to address security gaps that allow messaging accounts to remain operational even when the SIM used for registration is no longer present.
The requirements could particularly affect people who use messaging applications on secondary phones, Wi-Fi-only devices or multiple devices without keeping their registered SIM in the primary handset. Travellers who replace their Indian SIM cards with local numbers abroad may also need to consider how the changes affect their access.
The rules also address access through web and desktop versions of messaging services, with platforms required to implement safeguards against misuse of remotely accessed accounts. Earlier proposals for fixed six-hour logouts were reportedly revised in favour of risk-based logouts.
The DoT had initially issued the directions in November 2025, following concerns that fraudsters, including those operating from outside India, were exploiting messaging services to conduct scams using Indian telephone numbers.
The new framework seeks to strengthen traceability and prevent fraudulent accounts from continuing to operate after their associated SIM cards have been removed or deactivated. Platforms that fail to comply could face action under applicable telecommunications and cybersecurity regulations.