From Jan 1, WhatsApp, Telegram won’t work without SIM cards, govt issues guidelines

From January 1, 2027, India will require messaging services to keep user accounts continuously linked to an active SIM card. The SIM must be installed in the device where the app is running. This applies to accounts identified through Indian mobile numbers. The goal is to strengthen telecom cyber security and reduce fraud using those numbers.

For example, a WhatsApp or Telegram user cannot simply register with a number, remove the SIM, and continue using the app over Wi-Fi. If the SIM is removed, replaced, or deactivated, the service must stop until the valid, associated SIM is reinserted. Web versions must also log users out periodically, no later than every six hours, while allowing QR-code relinking.

The Department of Telecom has told covered platforms to integrate this system by December 31, 2026. The rule may affect Wi-Fi-only users, people with multiple devices, and those who frequently change SIM cards. Apple has updated iOS to help detect iPhones without physical SIMs.

SIM binding means a WhatsApp or Telegram account must remain continuously connected to the active SIM associated with the mobile number used to identify the user. The SIM must be installed in the device running the app. Registration alone will no longer be enough to keep the account functioning indefinitely.

For example, someone could register WhatsApp with an Indian number, remove that SIM, and previously continue using the account through Wi-Fi. Under the new requirement, the app must check that the specific associated SIM remains installed and active. If it is removed, replaced, or deactivated, functionality stops until a valid SIM is put back.

The Department of Telecom requires providers to build this link by December 31, 2026, for enforcement from January 1, 2027. Web sessions will also need periodic logout, no later than six hours, with QR-code relinking available. This could affect multi-device users.

The guidelines name seven major app-based communication services. They are WhatsApp, Telegram, Snapchat, Arattai, Sharechat, Jiochat, and Signal. Each is included among the providers directed to implement continuous SIM binding under the Telecom Cyber Security Rules, 2024.

The requirement means each named service must ensure that an account remains linked to the active SIM associated with the identifying mobile number. The SIM must be installed in the device where the service operates. Providers must also handle web sessions by logging them out periodically, no later than six hours, while allowing users to reconnect through a QR code.

The rules are scheduled to affect service use from January 1, 2027. Providers were told to integrate the account-linking system by December 31, 2026. The article specifically notes that Signal had not yet responded to government notices. Apple has separately updated iOS to help detect iPhones operating without physical SIM cards.

If the registered SIM is removed, replaced, or deactivated, the messaging app must stop functioning on that device. This remains true even when the user has Wi-Fi, because the new rule requires the app to stay linked to the specific active SIM used for registration or identification.

For example, a person might register Telegram with an Indian mobile number, remove that SIM, and try to keep chatting over home Wi-Fi. Under continuous SIM binding, the service must detect that the required SIM is missing or no longer valid. It must block functionality until the associated active SIM is reinserted. A replacement SIM may not satisfy the link unless it is the valid associated one.

This is likely to affect people who use messaging apps over Wi-Fi without registered SIMs, operate accounts on more than one device, or frequently change SIM cards. The requirement takes effect January 1, 2027, after providers integrate it by December 31, 2026.

The government believes SIM binding can reduce cross-border cyber fraud because some messaging services currently work even after the underlying SIM has left the device. That creates an opening for people outside India to use accounts identified with Indian mobile numbers. The stated concerns include cyber fraud, phishing, and digital-arrest scams.

For example, a fraudster could register an app using an Indian number, remove the SIM, and continue communicating through an internet connection. Continuous SIM binding would require the associated active SIM to remain installed in the device. If it is absent, replaced, or deactivated, the service must stop. This ties continued use more closely to the mobile connection used for identification.

The Department of Telecom issued directions under the Telecom Cyber Security Rules, 2024. Covered providers must integrate the system by December 31, 2026, before the requirement begins January 1, 2027. The article presents the measure as a way to curb misuse and enhance telecom cyber security.

A messaging account can currently keep working after its original SIM is removed because the service may accept the number during registration without continuously checking whether that SIM remains in the device. An internet connection, including Wi-Fi, can then carry messages while the underlying subscriber identity module is absent. The Department of Telecom identified this feature as a security weakness.

For example, someone registers an app with an Indian mobile number, removes the SIM, and continues using the account on Wi-Fi. Continuous SIM checks would require the specific active SIM associated with that number to remain installed. If the check fails because the SIM is missing, replaced, or deactivated, the app must stop. Web sessions must also be logged out periodically, no later than six hours.

The change is designed to limit misuse of Indian numbers, including fraud from outside the country. Providers must implement it by December 31, 2026, for the January 1, 2027, requirement. This may disrupt Wi-Fi-only and multi-device use.

A SIM card, or subscriber identity module, is a small card containing credentials that identify a mobile subscription to a telecom network. The mobile number is associated with that subscription by the operator. When the SIM is inserted into a phone, the network can recognise the subscriber and provide mobile service through that device. The SIM is therefore linked to the subscriber and, while inserted, the device using the subscription.

For example, an app may use an Indian mobile number to identify an account. The new rule requires the associated active SIM to stay inside the device running the app. If the card is removed, replaced, or deactivated, the app must detect that the required subscriber identity is no longer present and stop functioning until a valid SIM is reinserted.

The article says this continuous link is intended to reduce fraud using Indian numbers. Providers must implement it by December 31, 2026, with enforcement from January 1, 2027. This explanation of SIM technology uses established telecom knowledge beyond the article.