Under India’s SIM binding rule, WhatsApp and seven other messaging apps are expected to work only while your registered SIM sits in your phone. In practice, that applies from January 1, 2027. Government officials told PTI and the Hindustan Times in April that the compliance deadline is December 31, 2026. One part of the original order has already changed. The forced six-hour logout for WhatsApp Web and other web sessions has been dropped. Web and desktop sessions will now be logged out based on risk, with no fixed interval.
Here is what the SIM binding rule says, who it is likely to hurt, and what is still unknown. We also look at whether it will actually slow down the scammers it targets.
What India’s SIM binding rule actually says
The Department of Telecommunications (DoT) issued the directions on November 28, 2025, under the Telecom Cyber Security Rules, 2024. A Press Information Bureau release made them public on December 1. The order names eight apps: WhatsApp, Telegram, Snapchat, Arattai, ShareChat, Josh, JioChat and Signal. It covers app-based communication services that use an Indian mobile number to identify their users.
The core requirement is simple to state. Each app must stay continuously linked to the SIM card installed in the device. Without that specific, active SIM, the app should not work at all. Today, an account keeps working after its SIM is removed, deactivated or taken abroad. DoT says scammers exploit exactly that gap.
The release links the problem to digital-arrest scams, impersonation and phishing. It also cites investment and loan fraud. The government puts cyber-fraud losses at more than ₹22,800 crore in 2024 alone. It points to banking and UPI apps as a model, since they already bind themselves to the SIM in your phone.
Roaming is explicitly protected. If your Indian SIM stays in the handset while you travel, the direction does not apply to that situation.
How the deadline moved to December 31
The original order gave platforms 90 days to implement the change and 120 days to report compliance. According to PTI, that pointed to late February and late March 2026. In early March, Communications Minister Jyotiraditya Scindia told reporters an extension was not being considered, ThePrint reported. About a month later, the deadline moved anyway.
In early April, an official told PTI the government had extended applicability to December 31 after representations from industry. A DoT official quoted anonymously by the Hindustan Times said compliance could roll out in phases. That official expected the outstanding issues to be resolved by December 31, 2026.
A note on the paperwork. We could not find a gazette notification or PIB text formally recording the extension. The December 31 date rests on officials’ statements reported by PTI and the Hindustan Times. Some recent explainers give January 1, 2027 as a start date. No official document we reviewed sets that date, so read it simply as the first day after the reported deadline.
The six-hour web logout is gone
The original direction had a second requirement that would have hit desktop users hardest. Web sessions were to be logged out at least every six hours, forcing a fresh QR-code scan each time. By April 2026, that requirement had been dropped.
Minister of State for Communications Pemmasani Chandra Sekhar addressed it in a written Rajya Sabha reply on April 2, 2026. He said web sessions will be logged out when a risk assessment calls for it, and no fixed interval applies. PTI described this as AI-driven risk analysis carried out by the platforms themselves. Trade publication tele.net.in reported that sessions must end immediately when fraud is suspected.
For anyone who works from WhatsApp Web all day, this is a genuine improvement over a six-hour timer. It also hands the apps a vague and opaque power. How platforms will judge risk, and which signals they will use, has not been made public. If you are logged out mid-workday, you may never learn why.
What changes for you
For people with one phone and one SIM, very little should change. If your WhatsApp number belongs to the SIM inside your phone, the app should keep working as it does today.
WABetaInfo spotted the feature in development in WhatsApp Android beta 2.26.8.6 in February. It described a background check confirming the registered SIM is still in the phone. If the check fails, access is restricted, though WABetaInfo said chat history stays intact. Meta confirmed to MediaNama in April that it was testing SIM binding with regular WhatsApp users in India.
The trouble starts when your setup is anything other than one phone, one SIM and one person. That describes a lot of Indian households.
Who gets hurt by SIM binding
Travellers and NRIs
Roaming on your Indian SIM is protected by the order. Swapping to a cheaper local SIM abroad is a different matter. Many travellers do exactly that and keep WhatsApp running over Wi-Fi or local data. The Internet Freedom Foundation (IFF), which has asked DoT to recall the direction, warned that
users traveling abroad may lose access to their home-country-registered apps if they switch to a local foreign SIM card, even with Wi-Fi access, unless the original SIM is maintained as active and present in the primary device.
For Indians living abroad, the question is sharper. Many NRIs keep an Indian number on WhatsApp without carrying that SIM in their everyday phone. The order targets services that use Indian mobile numbers to identify users. It does not address NRIs specifically, and the government has not explained how they will be handled.
Shared phones and family SIMs
A survey by CUTS International found that about 86% of users let family members use their phone or SIM for messaging. In 39% of those cases, the main SIM holder may not be physically present when the app asks for authentication. Picture an elderly parent whose WhatsApp runs on a number registered to a child working in another city.
Under the order’s wording, setups like that would fail the SIM check. Exactly how the apps will respond is not yet confirmed. CUTS also found that 80% of consumers and over 60% of small businesses expect operational disruption.
Multi-device and business users
WhatsApp’s companion mode lets one account run on a tablet, a laptop and the web at the same time. The order deals with web logouts but gives no detail on how other linked devices behave under binding. IFF says multi-device users will face frequent interruptions.
TechCrunch has reported that businesses running WhatsApp Business from desktops are especially exposed. The scale is large, too: TechCrunch counts more than 500 million WhatsApp users in India.
Will SIM binding actually stop fraud?
The goal deserves to be taken seriously. The government’s ₹22,800 crore loss figure for 2024 is a large number. DoT’s argument is that accounts outliving their SIMs make cross-border scams easier to run. MediaNama reported that telecom operators backed binding for traceability through their industry body, COAI.
The weak point is the SIM itself. IFF cites researcher Anand Venkatnarayan, who says scammers obtain SIMs with borrowed or forged IDs and bypass KYC checks. A fraudster with such a SIM simply leaves it in the phone. Binding then confirms the scammer’s SIM, not the scammer’s identity. IFF says it is still unclear whether SIM binding will work at all.
There is a privacy cost too. IFF argues that a continuous link between SIM and app forces ongoing tracking of devices and app usage time. That is a lot of new monitoring for hundreds of millions of users who have done nothing wrong.
Industry has pushed back as well. The Broadband India Forum counts Meta and Google among its members. It wrote to DoT Secretary Amit Agrawal on February 23, 2026. Its letter attached a senior counsel’s opinion calling the direction beyond the parent law’s powers and unconstitutional. IAMAI has also urged a rollback, according to tele.net.in. As of October 23, no court challenge had surfaced in the reporting we reviewed.
Our view: binding does close a real loophole, since accounts will no longer survive a removed or deactivated SIM. But the costs fall mostly on travellers, families and small businesses. Organised fraud rings that already source SIMs on fake IDs face a far smaller hurdle. Stricter checks at the point of SIM issue would go after the root problem more directly.
What is still unknown
Plenty of practical details remain open about ten weeks before the deadline. These are the questions we would want answered.
- Does enforcement really start on January 1, 2027? Officials named December 31, 2026 as the compliance deadline, and one said rollout could be phased.
- Will iPhones be covered at the same time? PTI and tele.net.in reported that iOS posed technical constraints and that Android would come first.
- How will dual-SIM phones and eSIMs be treated? There is no official word on whether the registered SIM can sit in either slot.
- What happens on tablets, laptops and Wi-Fi-only devices? Beyond the logout rule, the order is not specific.
- What exactly happens when the SIM check fails? The only description so far is WABetaInfo’s account of a restricted mode.
- Is Snapchat in or out? The PIB release names it, though at least one recent report claimed an exemption without citing a source.
- Where do the other apps stand? Telegram and Snapchat did not respond to MediaNama, and we found no public statement from Signal. Arattai was the only platform that replied to MediaNama, confirming it is building compliance features.
- Are the apps ready? tele.net.in reported that platforms expected readiness across Android and Apple devices only by October to November 2026.
What you should do now
- Check which number your WhatsApp uses. Compare the number on your WhatsApp profile with the SIM physically inside your phone.
- Move mismatched accounts early. If the numbers differ, consider WhatsApp’s change-number option to move the account to the SIM you actually carry.
- Sort out family accounts. Find accounts that run on a relative’s number from a phone that does not hold that SIM. Fix them before December.
- Plan your travel SIM setup. On a dual-SIM phone, keeping the Indian SIM in one slot beside a local SIM looks like the safest bet. The order only requires the SIM to be present, but dual-SIM handling is not officially confirmed.
- Keep that Indian SIM active. The order requires an active SIM, so a parked number still needs a valid recharge. Our explainer on TRAI’s voice-and-SMS-only recharge order covers that option.
- Back up your chats now. WABetaInfo says history stays intact, but a fresh backup costs nothing if your account gets restricted.
- Expect random web logouts. Keep your phone nearby to rescan the QR code if WhatsApp Web or Desktop drops your session.
- Treat SIM-binding messages with suspicion. Scammers like regulatory deadlines, so trust prompts inside the app, not SMS links asking you to verify.
WhatsApp is also testing on-device scam alerts for messages from strangers, which target the same fraud problem from a different angle. We will update this story once DoT or the platforms publish final details on how binding will work.
Source: PIB / Ministry of Communications, Internet Freedom Foundation, CUTS International, MediaNama (April 2026), MediaNama (November 2025), PTI via Inc42, tele.net.in, ThePrint, TechCrunch
