When you open WhatsApp or Telegram on a tablet, a laptop, or a spare phone, you can usually stay logged in even if the SIM that originally registered the account is removed. That convenience has been a hallmark of the apps’ appeal in India, where billions of messages cross state lines every day. Yet the same flexibility also creates a blind spot for law‑enforcement and cyber‑security agencies, who argue that a detached account can be used to mask the true source of malicious activity.
On November 28, 2025, the Department of Telecommunications (DoT) issued a formal directive that laid out the technical specifications for “SIM binding” – a process that forces an app to confirm that the phone number linked to a user’s account is physically present on the device’s SIM card. The directive did not merely suggest a best practice; it set a binding regulatory deadline. By December 31, 2026, messaging platforms must have built the capability to enforce the rule, and the enforcement date is fixed for January 1, 2027.
The Telecommunications Ministry, responding to inquiries from the app companies in late 2025, granted a grace period that runs until the end of 2026. During this window, WhatsApp and Telegram are expected to roll out beta tests, fine‑tune the user‑experience, and ensure that the verification flow works across the myriad Android and iOS devices that dominate the Indian market. The Ministry’s response, logged on October 23, 2026, reaffirmed the DoT’s timeline and underscored that the rule is non‑negotiable.
The Ministry’s response, logged on October 23, 2026, reaffirmed the DoT’s timeline and underscored that the rule is non‑negotiable.
Under the new regime, a user who swaps SIM cards or moves an account to a device without the original chip will find the messaging app refusing to launch or to send messages until the correct SIM is re‑inserted. The apps will no longer allow a seamless transition between devices without re‑verification. For most users, this means a brief interruption when changing phones, but for the government, it creates a verifiable link between a phone number and a physical device at any given moment.
The DoT framed the rule as a cybersecurity safeguard. By anchoring a mobile number to a specific SIM, authorities argue that it becomes harder for malicious actors to hide behind disposable numbers or to hijack accounts after a SIM swap. In a country where mobile‑based authentication underpins banking, digital payments, and even voting‑related services, the regulator sees a direct line between a verified SIM and reduced fraud.
As the January 1, 2027 deadline looms, developers at WhatsApp and Telegram are racing to integrate the verification APIs mandated by the DoT. Users are being warned through in‑app notices and media briefings to expect a brief login hurdle if they change SIMs after the cut‑off date.
The rule is now set in stone, with the regulatory timeline clearly mapped: directive on November 28, 2025; Ministry’s acknowledgment on October 23, 2026; compliance deadline on December 31, 2026; and full enforcement on January 1, 2027. As the Indian digital ecosystem prepares for this shift, the balance between convenience and security will be tested on the backs of everyday users who have come to expect instant, SIM‑agnostic messaging.
The coming months will reveal how smoothly the industry can adapt, and whether the intended cybersecurity gains will materialize without eroding the seamless experience that made WhatsApp and Telegram household names across the subcontinent.