Millions of messaging app users in India could see their accounts stop working on secondary phones, tablets, and other devices that lack an active, registered SIM card once a new government requirement takes effect. The rule, expected to kick in on January 1, 2027, introduces what regulators are calling SIM-binding — a persistent, ongoing link between a messaging account and the physical SIM card tied to its registered mobile number.

What SIM-Binding Actually Changes

Today, apps like WhatsApp typically verify a phone number once, via a one-time text code, and the account then keeps working indefinitely regardless of whether that SIM stays in the phone. SIM-binding would change that fundamental assumption: under the new rule, continued access to the account would depend on the SIM remaining active and present, not just on having passed verification at signup. Platforms reportedly have until December 31, 2026 to bring their systems into compliance before the rule takes effect the following day.

The requirement traces back to the Department of Telecommunications’ directions issued on November 28, 2025 under India’s Telecom Cyber Security Rules, 2024, as subsequently amended. According to the government’s own explanation of the policy, the services named as covered include WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh, and JioChat.

The Problem the Government Says It’s Solving

The Department of Telecommunications has framed the change as a response to a specific abuse pattern: once an account is verified, it can keep functioning even after the associated SIM is removed, deactivated, or discarded entirely — which the government says criminals exploit to run accounts remotely, including from outside India, while still appearing to use a legitimate Indian phone number. That gap has reportedly been used to facilitate phishing, investment fraud, and scam calls impersonating government officials. Officials have cited cyber-fraud losses exceeding ₹22,800 crore (roughly $2.7 billion) in 2024 alone as part of the justification for tightening the rule.

By forcing continued access to depend on an active, present SIM, the government’s stated goal is to make these accounts easier to trace back to a real, currently-reachable number — closing off the option of operating an account indefinitely after cutting ties with the original SIM.

What’s Changed Since the Original Order — and What Hasn’t

The original directive also called for a blanket rule forcing web sessions to log out automatically at least every six hours. More recent reporting, including from CNBC-TV18, indicates that blanket requirement has since been softened into a risk-based approach: sessions would instead be ended when the platform detects suspicious activity, rather than on a fixed timer for everyone. That’s a meaningful change for frequent travelers and anyone who regularly swaps SIMs, since a flat six-hour rule would have been disruptive for entirely legitimate use.

Officials have also clarified that ordinary roaming is not affected, as long as the originally registered SIM remains physically in the device — the rule targets accounts that have been severed from their SIM entirely, not phones simply roaming on a different network.

Why This Doesn’t Solve Every Account-Security Problem

Security researchers are cautioning that SIM-binding addresses number misuse specifically, not every way these accounts can be compromised. WhatsApp, for instance, has separately dealt with so-called “GhostPairing” attacks, in which a victim is socially engineered into approving an attacker’s device as a linked device on their own account — a technique that doesn’t require controlling the victim’s SIM at all. Similar campaigns have abused WhatsApp’s legitimate device-linking flow through convincing phishing pages. A rule that ties an account to its SIM does nothing to stop an attacker who tricks a user into authorizing a malicious linked device directly.

For now, users in India relying on WhatsApp or similar apps on secondary phones, tablets, or devices without an active SIM should treat January 1 as a target date rather than a guarantee — actual disruption will depend on how quickly each platform finishes implementation, and companies may stagger changes rather than flipping a switch for everyone simultaneously. In the meantime, security teams and individual users alike are advised to:

• Review the Linked Devices section of WhatsApp (and equivalent settings on other covered apps) and remove any sessions that aren’t recognized.
• Be skeptical of any message or page requesting approval of a new linked device, since this remains a viable attack path regardless of SIM-binding.
• Plan ahead for any secondary device or tablet that currently relies on these apps without its own active SIM, since continued access after the deadline is not guaranteed.

The rule marks one of the more significant regulatory shifts in how India intends to govern messaging-platform security, and other jurisdictions dealing with similar SIM-swap and account-takeover fraud patterns will likely be watching how smoothly — or roughly — the rollout goes.