One major change could be expected in the way that WhatsApp and other messaging apps are used in India, but the government's SIM-binding directive will come into effect from January 1, 2027 after a December 31, 2026 compliance deadline.
Messaging apps that rely on Indian mobile numbers for identification will be required to ensure the right SIM card is connected to the application on the device. The goal of the measure is to increase digital security, trace mobile numbers and prevent messaging apps from being used for cybercrime. But the quality of the user experience will depend on how the platforms implement it.
The directive was issued in November 2025 under the telecom cybersecurity framework in India. It covers various communication platforms such as WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat.
The government said some of these services allowed users to continue using accounts even after the associated SIM card had been removed, deactivated or moved to another device. This void could be exploited by fraudsters (who are from outside India) to use Indian mobile numbers for impersonation and online scams. The compliance deadline was extended to December 31, 2026 after implementation challenges were raised.
What is SIM binding and how will it work?
SIM binding means that the application linking a messaging app to the SIM card associated with the mobile number used in registering the account is always on. As per the directive, the SIM card must be in the device running the application. In other words, users may no longer be able to rely on an account being active indefinitely on a phone if they remove the SIM card. However, application verification will depend on how the app works with SIM replacement, device change and technical error.
WhatsApp users would be especially worried because people use the service on several devices and can access the service on multiple devices. Some users open WhatsApp Web on office computers and others use a colleague's device or take a mobile phone at work. SIM binding is intended to make certain the account is still connected to the registered mobile number, which is why some existing usage habits will be more difficult to manage.
Why is the government imposing the rule?
The main goal is to reduce cybercrime involving mobile-number-based identities. A fraudster can use messaging apps to impersonate bank employees, government officials, relatives or business representatives. They can also use messaging accounts to spread phishing links and promote fraudulent investment schemes and conduct so-called digital-arrest scams. If a service continues to operate without the associated SIM being present, investigators may have even more difficulty establishing the connection between an account and the mobile number used to register it.
It is the government’s view that continuous SIM binding can also make ownership more transparent and allow telecom identifiers to be used to monitor and prevent abuse. SIM binding is a part of a bigger effort to strengthen cybersecurity and limit the financial losses from cybercrime. But SIM binding cannot reduce cybercrime by itself. Criminals may still use stolen credentials, compromised devices, fake SIM registration or any such thing to trick victims. So when someone gets a new call or text in a foreign country, they will need to be aware of it and look out for that.
Will WhatsApp Web log out every six hours?
In fact, the original directive called for periodic logout of the web version of the messaging service and sessions to be no longer than six hours long. However, the government later changed to a risk-based logout for web sessions. In an April 2026 report, the new position is that the sessions should be terminated based on risk and not be required to be continuous for 6 hours. So we should not think that a mandatory 6-hour logout is the final requirement.
What should users do before January 2027?
The mobile number of those accounts should be linked to the registered mobile number in the app and the registered SIM is working. Anyone who wants to replace a SIM and change a mobile number or move an account to another device should follow the platform’s official instructions. You also need to keep account recovery information current, access the security features you can already use for your account and don’t give verification codes to anyone else.
People travelling abroad should not assume they will lose access to their messaging accounts. The government has added that its direction does not affect cases in which the relevant SIM remains present in the handset and the user is on roaming. However, those who need messaging services while traveling should check the latest platform guidance.
The SIM-binding directive has made a significant change for messaging-app security in India. The deadline on December 31, 2026 sets the compliance target, and January 1, 2027 is when we think people will start to get used to the new system if the deadline remains unchanged.
Users will need to be careful how platforms will implement the requirement in a way that doesn’t inconvenience people who genuinely need multiple devices. Users should take the date to be an implementation milestone, not a day in the life of every feature and do it just as the companies have said they will.
Comments
Leave a Comment