WhatsApp users in India are facing a potential change that could alter how accounts work on secondary devices. Under new directions from the Department of Telecommunications (DoT) tied to the Telecom Cyber Security Rules, messaging services may be required to keep an ongoing link between an account and the SIM card registered to that number. With an expected implementation window beginning January 1, 2027, and a compliance deadline of December 31, 2026, many people who rely on tablets, companion phones, or devices without an active registered SIM could see their sessions interrupted unless platforms adopt specific workarounds.
What SIM-binding means
SIM-binding creates a continuous association between a messaging account and the physical SIM installed in the device that holds the registered number. This is different from the familiar one-time SMS verification code; SIM-binding requires the service to verify that the registered SIM remains present or accessible in the device over time. The DoT says the change is intended to make it harder for criminals to operate Indian numbers remotely — for example, from outside India — and use them for phishing, investment scams, or impersonation of government agencies.
Who and what’s affected
The DoT’s original directions, issued on November 28, 2025, name major messaging platforms such as WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat among those covered. The new requirements could affect:
- Users who run an account on a secondary phone that doesn’t carry the registered SIM.
- People using tablets or other devices linked via companion sessions.
- Travelers who temporarily deactivate, remove, or swap SIMs while abroad.
How each platform handles tablets, companion phones and linked devices will determine the real-world impact; the policy leaves room for platform-specific implementations.
Why the government is pushing this change
Indian authorities cite persistent misuse of mobile numbers in large-scale frauds — the government referenced reported cyber-fraud losses exceeding ₹22,800 crore in 2024. By making it harder to use Indian numbers from devices where the registered SIM is absent, regulators aim to improve traceability of accounts and disrupt the infrastructure criminals exploit. The policy also ties into broader Telecom Cyber Security Rules intended to reduce opportunities for remote account abuse.
Limitations and residual risks
SIM-binding addresses one vector of number misuse, but it’s not a complete fix. Device-linking scams remain a serious threat: attackers can still trick victims into approving a linked device (for example, via WhatsApp’s Linked Devices feature) and then operate the account from that device. Reported GhostPairing attacks and campaigns that abuse legitimate linking workflows show that control over a phone number alone does not prevent all account takeovers. Additionally, enforcement and platform implementation detail will determine whether SIM-binding materially reduces fraud or simply shifts attacker tactics.
What users should do now
Users should take several practical steps to protect their accounts as platforms adapt to any SIM-binding requirements:
- Review linked and active sessions in your messaging apps and remove any unfamiliar entries.
- Avoid approving new linked devices or companion sessions unless you initiated them.
- Keep your SIM physically secure and be cautious with SIM swap or social-engineering attempts targeting your carrier.
- Follow official updates from your messaging provider so you know how they’ll implement any SIM-binding controls and what changes to expect for tablets and companion devices.
Timeline and expectations
January 1, 2027 is currently the earliest expected rollout date mentioned in reporting; messaging platforms have reportedly been given until December 31, 2026 to make necessary changes. That date should be treated as an expected start rather than a guarantee of immediate disruption for every user. Actual effects will depend on how platforms implement risk-based logouts, session checks, and whether they permit alternative verification methods for specific device types or travel scenarios. Earlier language that required web sessions to log out every six hours has reportedly been softened in favor of risk-based logouts that trigger on suspicious activity.
Final perspective
SIM-binding is a pragmatic step aimed at reducing the ease with which bad actors weaponize Indian numbers for fraud. But it’s not a silver bullet. Users should pair awareness of the new rule with long-standing security habits—regularly checking linked devices, using app-level security features, and staying alert for SIM-targeted social engineering. As platforms roll out their responses, the balance between security, usability, and cross-device convenience will determine how disruptive this change feels for everyday users.
Licensed under CC BY-ND 4.0 International
