WhatsApp, Telegram Must Enforce SIM Binding Under New Government Rules

WhatsApp New Rules: The Department of Telecommunications has issued fresh directions requiring major messaging platforms such as WhatsApp, Telegram, Signal, Arattai, Snapchat, ShareChat, JioChat and Josh to ensure their services cannot be used without an active SIM card. The directive follows the introduction of the Telecommunication Cybersecurity Amendment Rules 2025 which brought a new category called the Telecommunication Identifier User Entity under the telecom regulatory framework.

Under the amended rules, TIUEs are entities that use a mobile number to identify users or deliver services. These entities must meet a wide range of cybersecurity obligations including using the Mobile Number Validation platform to verify customers for any service linked to a mobile number. The government may also instruct TIUEs to stop using a specific number for customer identification or service delivery if required.

When this new category was first introduced experts raised concern that its scope was extremely broad because almost any platform collecting mobile numbers could fall under it. This included food delivery platforms, fintech apps and even small businesses using mobile numbers to send receipts.

The latest directions confirm that major communication apps are now formally recognised as TIUEs. These apps must ensure continuous SIM binding within the next ninety days. This means a user cannot continue accessing the service if the SIM used for verification is removed, replaced or deactivated. For web or browser-based access, TIUEs must automatically log users out within six hours and offer a QR-code-based relinking option.

WhatsApp New Rules: Why the government wants SIM binding

The government said some apps allow users to continue operating their accounts even when the linked SIM is not present in the device. According to officials this gap is being exploited by fraudsters operating from outside India to commit cyber crimes against Indian users. The rationale supports the Cellular Operators Association of India which previously said that apps must maintain a persistent link with the user’s mobile number.

The industry body pointed out that most communication apps verify a number only once during installation. The app then works independently of the SIM which allows misuse because authorities cannot rely on call records, tower location or carrier logs to trace activity if the SIM is absent. Persistent SIM binding would ensure communication services operate only with the authenticated SIM inserted in the device which helps maintain traceability between the user, the number and the device. COAI argued that this will significantly reduce spam messages and online fraud and will discourage misuse of these platforms.

Other sectors that already use SIM binding

Banking and UPI platforms already enforce strict rules that require the verified SIM to remain active in the device to prevent fraud. Earlier this year SEBI proposed mandatory SIM linking for trading accounts along with biometric checks so that only the genuine account holder can access the platform.

Will SIM binding reduce fraud

Cybersecurity experts said the impact may be limited. At a MediaNama event in 2023 researcher Anand Venkatnarayan noted that scammers routinely use forged or loaned IDs to obtain SIM cards. He said fraudsters need only a small number of SIM cards to target hundreds of victims because they never reuse SIMs. In such cases SIM binding may not achieve the intended protection because scammers can simply acquire new SIMs.

Industry professionals also questioned whether the telecom subscriber database is reliable enough to serve as a foundation for cybersecurity. During discussions last year MediaNama’s editor highlighted that video KYC through the ASTR database has been operational for two years yet telecom fraud has not reduced. Critics argued that moving the same identity verification methods into another ecosystem may not improve trust.

COAI said the government wants to maximise the usefulness of the telecom database since the mobile number is the most widespread and actively updated identifier in the country. Officials view it as a national resource that can strengthen cybersecurity if leveraged effectively.

Full text of the directions

The directions were issued under the Telecommunications Cyber Security Rules 2024 as amended in 2025. They instruct TIUEs that use mobile numbers for user identification or service delivery to take several compulsory steps.

Within ninety days they must ensure app-based services remain continuously linked to the SIM associated with the user’s mobile number making it impossible to use the service without the same active SIM. They must ensure web versions of apps log users out automatically within six hours and offer a QR-based relinking feature. Compliance reports must be submitted within one hundred and twenty days. Failure to comply will invite action under the Telecommunications Act 2023, the Cyber Security Rules 2024 and other applicable laws.

The order takes immediate effect and will remain active until modified or withdrawn.

(The content is sourced from agencies and has not been edited by mtimes.co.in.)

Get Latest News Live on MTIMES along with Breaking News and Top Headlines, Political News and around The World.

You May Like

Trending Searches Today |

Lenskart Solutions IPO Opens on October 31: Price Band, Allotment, Listing Date, and Review

Donald Trump Calls PM Modi ‘Nicest-Looking Guy’ and ‘Tough as Hell’

CBDT Extends ITR Filing Deadline for AY 2025-26 to December 10

CBSE Releases Date Sheet for Class 10 and 12 Board Exams 2026

Mumbai Indians Confirm Rohit Sharma’s Future Amid Trade Rumours To KKR

TRAI Introduces CNAP: India’s Verified Caller ID System to Curb Scam and Spam Calls