India's SIM binding turns a fraud fix into a tax on everyone

What if your messaging app stopped working the moment you took the SIM out of your phone? That is not a hypothetical in India. It is the plan, and it now has a date.

As The Times of India reports, India has made SIM binding mandatory from January 1, 2027, meaning apps like WhatsApp and Telegram will not work without an active SIM. The rule comes from the Department of Telecommunications (DoT), which first issued its directions in late November 2025 and has since moved the deadline. According to the Economic Times' BrandEquity, the date was pushed to December 31, and a risk-based logout replaced the mandatory six-hour logout.

The target is real, but the aim is off

The problem the DoT describes is genuine. The directive talks about plugging "a concrete security gap that cybercriminals are exploiting to run large-scale, often cross-border, digital frauds," according to an analysis by GoTrust. The pattern: register an account with an Indian number, pull or deactivate the SIM, and keep operating from abroad through linked devices.

We understand the logic. Our doubt is whether it works. The Internet and Mobile Association of India, which represents Meta among others, told the communications minister in a letter, as The Hindu reported, that there is "limited evidence" SIM binding will meaningfully cut fraud. Its argument is simple: fraud centers can still get Indian SIMs through mule networks, and domestic scammers use fake or borrowed IDs, use a SIM briefly, then discard it.

That last point is the heart of it. A rule that checks whether a SIM is present does not check whether the person behind it is honest. Criminals who already live on disposable SIMs, we suspect, pass the test easily. The honest user with a dead SIM or a trip abroad is the one who gets locked out. In our view, that is a poor trade.

The cost lands on ordinary users

Think about who actually removes a SIM. Travelers who use an international number. People with a secondary device. Small business owners who run customer chats from a laptop all day. The IAMAI letter warned about exactly these cases, and about the disruption to MSMEs that rely on web messaging for orders and support.

The revised directive dropping the six-hour web logout is good news, and it suggests the original design was too blunt. But "risk-based" is a vague phrase. Who defines the risk, and what signals does the app collect to decide? Our concern is that continuous checks of SIM presence and risk scoring push messaging apps closer to being telecom-style identity checkpoints. The directive reportedly designates these platforms as Telecommunication Identifier User Entities, putting them under oversight normally reserved for carriers.

There is also a legal question. The IAMAI argues that over-the-top services fall outside the Telecommunications Act, 2023. We cannot judge who is right, but when the industry itself says the regulator may lack the power, a template deserves scrutiny before anyone copies it.

The template risk is the real story

Here is the part that should interest readers outside India. Once messaging accounts are legally tied to a phone number and a physical SIM, the phone number stops being a convenience and becomes an identity anchor. Every government that worries about anonymous or cross-border abuse could have a reason to ask for the same thing. This is a forecast, not a fact, but it is a natural one.

Apps like Signal, which are cited among the affected platforms, have built their reputations on collecting as little as possible. Making them verify SIM presence runs against that grain. Encryption of message content may well remain intact, but in our view a system that continuously proves "this account is tied to this SIM" could create metadata and leverage that did not exist before.

Our verdict

Fighting digital arrest scams and offshore fraud is urgent. But the evidence offered so far suggests SIM binding is a blunt instrument that scammers can route around and users cannot. Tighter KYC, better SIM lifecycle controls and fraud detection that works whatever the device, the alternatives the IAMAI itself points to, look more promising.

If you are in India, plan ahead: keep your registered SIM active and in your primary phone before January 1, 2027, and check how your web and secondary-device habits might change. If you are elsewhere, pay attention. The question is not only whether this rule works in India. It is whether it becomes the default answer everywhere.