India is getting ready to tie major messaging apps to a phone’s SIM card. The rule starts on January 1, 2027, and covers WhatsApp, Telegram and Signal. Affected accounts will stop working on devices without the active SIM. That SIM must match the user’s registered mobile number.
The government says the measure will help prevent cyber fraud, impersonation and scams involving Indian phone numbers. The new rules also raise privacy and access concerns.
The Department of Telecommunications (DoT) first issued the order on November 28, 2025. It acted under India’s Telecom Cyber Security Rules. Reports from October 22 and 23, 2026, set out the latest timeline. Platforms must comply by December 31, 2026. The government wants to strengthen telecom security. It also wants to curb cybercrime that involves Indian mobile numbers.
Eight messaging apps face the January deadline
The order covers WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat. However, recent reports suggest Snapchat may not need to comply. The status of each platform still needs clarification.
Under the rules, messaging services must keep each account linked to one SIM. That SIM is the one used for identification or service delivery. In simple terms, the account and the SIM must stay together. If a user removes or deactivates the SIM, they may lose access. Access returns only after the SIM is restored and verified.
This could affect people who use Wi-Fi-only devices. It could also affect people who keep their registered SIM in a different phone. Travellers who switch to a local SIM abroad may face the same problem. Those users may need their registered SIM before they can sign in again.
The original order also asked for regular logouts from web versions of messaging apps. Users then had to scan a QR code to link their account again. The government first set a maximum web session of six hours. Later reports say the rule has shifted toward risk-based logouts. It no longer applies a six-hour limit to everyone. So users should treat SIM binding and web-session rules as two separate things.
Apple has also made software changes. These help apps check whether an iPhone has a relevant SIM or active mobile plan. However, Apple’s changes only help apps run the check. The final setup will depend on the operating system and app permissions. It will also depend on how each messaging platform uses the checks.
Government points to fraud losses while privacy questions grow
The DoT says criminals misuse messaging accounts that stay active without their registered SIM. Sometimes the SIM has been removed or moved abroad. According to the department, this helps criminals run phishing, impersonation and investment scams. It also helps them run so-called digital arrest scams. The government reported that cyber fraud losses in India passed ₹22,800 crore ($2.40 billion USD approximately) in 2024, as stated in its release.
SIM binding should make it harder to run accounts without the linked SIM. However, the rule does not guarantee that fraud will stop. Criminals can still use stolen login details, phishing attacks, and malware. They can also use compromised devices and fraudulent SIM registrations. Phishing and malware still threaten accounts, so safe habits still matter.
The rule does not break end-to-end encryption by itself. It also does not prove that authorities can read private messages. Its more direct effect is a stronger link between a messaging account and a registered mobile number. This raises fair questions about traceability and identity protection. It also raises questions about how telecom information might work with other government systems.
These concerns matter in India, where rights groups have questioned internet restrictions and online censorship. Reporters Without Borders ranked India 157th out of 180 countries in its 2026 World Press Freedom Index. Freedom House also reported a decline in internet freedom. It cited shutdowns and limits on online content. These findings add context to the privacy debate. However, they do not show that officials introduced SIM binding to target political critics.
Age verification and online safety rules are also facing legal scrutiny elsewhere, including a Florida lawsuit against Discord over child safety and age verification.
Privacy tools stay useful, but do not replace the SIM rule
Users can still take practical steps to lower their risk. They should review their privacy settings first. They can limit who sees their phone numbers and profile details. Disappearing messages can help where they fit. Users can also verify security numbers with important contacts.
Signal offers end-to-end encryption by default for private chats. WhatsApp also protects personal messages and calls with end-to-end encryption. Still, neither service escapes India’s SIM-binding rule because of its stronger privacy features.
A reputable VPN can protect internet traffic on untrusted networks. However, it does not stop SIM-based identification. It also cannot guarantee anonymity. Using separate phone numbers for different services may keep some details apart. Even so, it does not remove legal identification requirements.
Ultimately, the impact depends on how platforms apply the rules. It will also depend on how consistently the government enforces them. Platforms still need to explain how they will follow the rules. The policy may make some fraud schemes harder to run. Still, people must weigh its value against the effect on ordinary users. That includes cross-device access and digital privacy.
