From 1 January 2027, using WhatsApp or Telegram in India may require something that has nothing to do with your password, your chats, or your encryption keys. Your registered SIM card will have to stay present and active in your phone. Take it out, let it go inactive, and access to the app may be blocked.
Web sessions get a second rule on top of that. WhatsApp Web and similar web clients will have to log out at least every six hours, and you will have to scan a fresh QR code from your primary phone to get back in.
This comes from India's Department of Telecommunications, under the Telecom Cyber Security Rules, 2024. The direction was first issued on 28 November 2025 to app-based communication services including WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat. Reports this month say the compliance deadline is 31 December 2026, with the operational rollout starting on 1 January 2027. Snapchat is reportedly exempt. Signal, according to the same reports, has not responded to the government notices.
The stated reason is fraud, and the numbers behind it are not small. Officials have linked scams run through untraceable or misused numbers to losses of more than 22,000 crore rupees a year. The specific scams named in the reporting are familiar ones: phishing, impersonation, and so-called digital arrest scams, where a caller pretends to be law enforcement and pressures a victim into paying. The logic of the rule is simple. If an account cannot be detached from a traceable SIM, it is harder to run a scam account at scale, and harder to keep using one after the number behind it is gone.
That logic is worth taking seriously, and so are its costs. Both are about the same question: what is an account, really?
A phone number was already an identity. A SIM check makes it a leash.
Most messengers already ask for a phone number at sign-up. That number is an identifier, and in many countries it is tied to a real person through SIM registration. But once you registered, the number mostly stayed in the background. You could move your SIM to another phone, leave an old phone at home on Wi-Fi, or use a tablet as your daily device, and the account kept working. Registration was a one-time check.
SIM binding turns that one-time check into a continuous one. The account is no longer just linked to a number. It is linked to a piece of hardware that must stay in the device, stay active, and stay in the right phone. That is a different kind of identity. It is not "you proved who you are once." It is "you keep proving, every day, that you still hold this SIM."
For many users, nothing will change. Their SIM is already in their main phone, and it stays there. The people who will feel it are the edge cases, and edge cases are where identity rules always break first:
- Someone who uses an old phone as a Wi-Fi-only device, with the main SIM in a different handset.
- Someone who keeps a work phone and a personal phone, and runs messaging on the one without the registered SIM.
- Someone who switches handsets often, or who travels and swaps SIMs.
- Someone who relies on a web client all day at a desk and will now be logged out every six hours, mid-work, and sent back to their phone for a QR code.
Reports say travellers on international roaming should be unaffected as long as the registered SIM stays active and inserted. That is reassuring, but it also shows where the line sits. The system does not care where you are. It cares whether the SIM is still in the phone. Presence has become the proof.
There is also an implementation gap that the reporting is honest about. How strictly each platform enforces the check, and on which devices, will vary. Apple reportedly shipped an iOS patch in September that can detect the absence of a SIM card, which helps developers implement the requirement on iPhones. Android is a more varied story, with different devices and configurations. A rule that lands differently on every phone is not quite one rule. It is a rule plus a set of platform quirks, and users will discover the quirks one failed login at a time.
A SIM proves a telecom account, not a person
This is the part builders should not blur. A SIM card proves that a device holds a subscription tied to a registered number. It does not prove that the person holding the phone is the person who registered that number. SIMs get swapped, stolen, handed to family members, and used in phones shared by a household. A fraudster who controls a SIM, or who socially engineers a carrier into issuing a replacement, passes a SIM check just as easily as a legitimate user does.
That does not make the rule useless. Raising the cost of running disposable accounts is a real gain against bulk scams. But it does mean SIM binding is an anti-abuse control, not an authentication upgrade. It answers "is this account still attached to a live, traceable number?" It does not answer "is this the right person?" or "is this the right key?" Those are different questions, and confusing them is how a fraud control gets sold as a security guarantee.
The same distinction applies to the six-hour web logout. As session hygiene, it is blunt but understandable. A stolen laptop, or a web session left open on a shared computer, stops being useful after six hours at most. As a daily experience, it is a tax on legitimate users, and a blunt timer is not the only way to get that hygiene. Per-device session lists, visible active sessions, one-tap revocation, and alerts when a new device links are all more precise tools. A timer that logs everyone out, careful user and careless user alike, is what you reach for when you do not trust the rest of the session system to do the job.
What this means for how I think about identity in my own messenger
I build a browser messenger, so I have had to make this choice in the other direction. My app does not use a SIM at all. A contact's identity in my app is tied to a key, and that key is checked with an ML-DSA-65 signature that the client verifies itself. If the signature does not verify, the contact does not get the verified badge, and a forged signature gets a loud warning instead of silent acceptance.
That design has its own trade-offs, and I do not want to pretend otherwise. A key you control is a key you can lose, and recovery is harder than calling a carrier for a replacement SIM. A SIM-tied account is easy to recover, precisely because a carrier can reissue it, but that also means the carrier is a gatekeeper over your account, and a point of failure if the carrier is tricked or compelled. A key-tied identity puts control and risk in the same place, with the user. A SIM-tied identity puts recovery in one place and control in another.
India's rule pushes the big commercial messengers further toward the carrier model. That is a policy choice with real benefits against a specific kind of fraud, and real costs for users whose setup does not match the assumed shape of one person, one phone, one SIM, always together. The question for builders watching this is not whether SIM binding stops some scams. It probably will. The question is what happens to the users it was not designed for, and whether the platforms will give them a clear path back in, or just an error screen.
There is a second question worth asking, and it is about precedent. India is a huge market for WhatsApp and Telegram. If a major market can require continuous SIM presence, other regulators will watch the rollout closely. A builder designing an identity system today should assume that phone-number identity may come with hardware strings attached in some markets, and that a design which only works when the SIM never leaves the phone is a design with a new failure mode built in.
A short, practical list
If you are in India and you use WhatsApp or Telegram, the reporting points to a few concrete steps before January:
- Make sure the SIM linked to your account is active and inserted in the phone you actually use every day, not in a drawer or a second handset.
- If you change your number, or move your SIM to another device, update your messaging registration promptly rather than leaving the old link in place.
- If you depend on a web client, expect the six-hour logout and plan for the QR re-link. Do not leave a web session as your only way into an important conversation.
- If you run a Wi-Fi-only tablet or a second phone as your main messaging device, rethink that setup now, while you still have time to move the SIM or the account.
If you build messaging software, the list is shorter and harder: decide what your account is tied to, say it plainly, and test what happens to a legitimate user when that thing disappears. A SIM, a key, a password, a device, each one fails differently, and your users will meet the failure mode you did not test.
India's rule is not about encryption. No message gets more or less encrypted because a SIM is in the phone. It is about the layer underneath encryption, the question of who is allowed to hold an account at all. That layer has always been a policy decision dressed up as a technical one. From January, in one of the world's largest messaging markets, the policy will be visible every time a SIM leaves a phone.
A note on honesty, as with my previous posts: my messenger is an experimental project built by one person. It has not been independently audited, and I do not present it as a finished product. This post is commentary on public reporting about India's Department of Telecommunications direction, not a claim about deployments I have not done.
Top comments (0)