Live SIMs Will Gate WhatsApp, and Scam Boxes Already Have Them

From January 1, 2027, WhatsApp and seven other chat apps in India must stay tied to the live SIM used at sign-up. The Department of Telecommunications set December 31, 2026 as the date platforms have to comply, after a year of delay.

On October 22, 2026, the day that timetable returned to national headlines, Karnataka’s Cyber Command said it had pulled ten SIM-box devices with a combined 320 SIM connections from two Whitefield apartments. Those racks already keep KYC cards physically live, which is the test the new chat rule adds.

A Live SIM Inside the Handset

DoT issued the SIM-binding directions on November 28, 2025 under the Telecommunications (Telecom Cyber Security) Rules, 2024, as amended. The December 1, 2025 public note names WhatsApp, Telegram, Snapchat, Arattai, ShareChat, Josh, JioChat and Signal, and tells those services to keep the account impossible to use without that specific SIM sitting in the device.

That is a different bar from today’s OTP. Most of these apps ask for a number once, then keep working if the card is pulled, swapped, parked in another phone, or left at home while the user sits on Wi-Fi. DoT says that gap is how Indian numbers get used for phishing, investment pitches, impersonation calls and remote “digital arrest” scams run from outside the country.

The same amendment package created a new class of firm, the Telecommunication Identifier User Entity, for any business that uses a phone number to identify a customer. Chat apps are being treated as TIUEs. DoT also plans a Mobile Number Validation platform so those firms can check whether a number is still a real, live line.

THE SIM BINDING CALENDAR

1. October 22, 2025: DoT notifies the Telecom Cyber Security Amendment Rules, adding TIUEs and the MNV platform.
2. November 28, 2025: Direction No. 2-16/2023-AI_DIU orders eight chat apps to bind accounts to the SIM in the device and to log web sessions out at least every six hours.
3. December 1, 2025: The Press Information Bureau publishes the mandate, with 90 days to build it and 120 days to file a report.
4. April 2, 2026: Minister of State for Communications Pemmasani Chandra Sekhar tells the Rajya Sabha the compliance date is December 31, 2026 and that web logouts will follow risk analysis, with no fixed interval.
5. December 31, 2026: Platforms must meet the live-SIM duty.
6. January 1, 2027: The requirement is due to operate for apps that are ready.

The original 90-day clock would have landed in late February 2026, with the 120-day report due March 28, 2026. Industry groups said Android and iPhone builds would not be ready that fast. The December 31, 2026 date is the extension Parliament was given in April.

Cyber Fraud Losses Hit ₹22,845 Crore in 2024

The home ministry’s Indian Cyber Crime Coordination Centre is the file DoT points to. Minister of State for Home Affairs Bandi Sanjay Kumar told the Lok Sabha that citizens lost ₹22,845.73 crore to cyber financial fraud in 2024 on the National Cyber Crime Reporting Portal and the Citizen Financial Cyber Fraud Reporting and Management System, up 206 percent from ₹7,465.18 crore in 2023.

CYBER FRAUD ON I4C SYSTEMS

Digital arrest cases, the video-call con in which someone pretends to be police or a court, accounted for ₹1,918 crore across 1,23,672 cases in 2024. Those jobs often start on a chat app and display an Indian mobile number. DoT’s note says a session can be proved once on a device in India and then run from abroad with no fresh check that the SIM is still in the phone.

The state is already cutting lines. Kumar said more than 9.42 lakh SIM cards and 2,63,348 IMEIs reported by police have been blocked. SIM binding is the next turn of that screw: keep the chat account glued to a card that is still in a handset, so a deactivated or exported number cannot keep talking.

Whitefield’s 320-Slot SIM Boxes

The Whitefield case is the other half of the same week. After a complaint from Bharti Airtel’s chief circle nodal officer in Bengaluru, Whitefield cybercrime police registered a case on August 26, 2026. A joint operation with DoT Karnataka then hit two apartments, one in Kadugodi and one in Pattandur Agrahara.

THE WHITEFIELD SEIZURE

• Devices: Ten GSM gateway SIM boxes, each with 32 slots.
• Kadugodi: Six boxes, 192 slots, loaded with e-SIM profiles from more than one telecom firm.
• Pattandur Agrahara: Four boxes, 128 slots, run by the same network.
• Arrests: Four people held on the e-SIM supply chain, with leads to Tiroda in Gondia district, Maharashtra.

DGP Cyber Command Pronab Mohanty’s note said the setup is suspected in digital arrest, sextortion and money fraud, and that early leads point to exposure in the hundreds of crores. A SIM box’s job is to keep Indian cards powered and registered so a call or message looks local. For the chat rule, that is not a bug in the fraud model. It is the model. The live-SIM test that honest travellers will have to pass is the state those racks were already in.

Anand Venkatnarayan, a cybersecurity researcher and DeepStrat co-founder, put the procurement problem more bluntly at a 2023 industry session: scammers “need 10 SIM cards for scamming a hundred victims; they don’t reuse SIM cards.” Binding WhatsApp to a card does not stop a crew that can buy a fresh KYC SIM, park it in a 32-slot box, and register a new account. It stops the person who already proved the number once and then took the card out.

Who Loses Access When the Card Comes Out

DoT’s own note says the direction does not hit a user who keeps the Indian SIM in the handset and is on roaming. The people in the blast radius are the ones who currently treat the number as an identity, not as a piece of plastic that has to stay in that phone.

THE ACCOUNTS MOST EXPOSED

• Wi-Fi-only tablets: Devices with no SIM slot cannot show the registered card as present.
• Second phones: An old handset running WhatsApp over Wi-Fi after the SIM moved to a new phone fails the continuous-link test.
• SIM swappers: Travellers who pull the Indian card and drop in a local SIM lose the Indian-number account unless the original card stays in the device.
• Web and desktop shops: Companion sessions still need the phone, and the phone still needs that SIM, even after the six-hour web logout was softened.
• Dual-SIM users: The bound account is the specific card used at registration, not whichever slot happens to have signal.

Esya Centre surveyed 2,033 consumers and 353 small businesses and found nearly all of those consumers would find SIM binding inconvenient. Shops that run customer chat from a laptop all day are the ones that turned WhatsApp into a till. About 500 million people in India use WhatsApp, so even a thin slice of tablet, travel and multi-device use is a large pile of accounts.

Broadband India Forum, which counts large internet firms among its members, told DoT the order sits outside the Telecommunications Act, 2023 and called it unconstitutional. Its letter also flagged a hardware fact the directions never really answer: many tablets and laptops have no SIM slot at all, so “continuously linked to the SIM installed in the device” has no clean meaning on the screen where a lot of work actually happens.

COAI Called the Mandate First-in-the-World

The Cellular Operators Association of India, which speaks for Reliance Jio, Bharti Airtel and Vodafone Idea, had asked for this. In the body’s telling, app chat currently binds to a SIM only at install, then runs after the card is removed, replaced or killed, which leaves police without call records, location or carrier logs for that session. COAI called the DoT move a first-in-the-world regulatory measure and said persistent binding would “ensure that the communication service cannot operate without the authenticated SIM physically inserted in the device, maintaining critical traceability between the user, the number and the device.”

Internet Freedom Foundation read that as the point, not a side effect. In a December 12, 2025 letter it asked DoT to recall the direction, arguing the live-SIM duty and the original six-hour web logout were a disproportionate grab at OTT apps through telecom law, after an earlier communications minister had said OTT would not sit under the 2023 Act.

… we request the DoT to recall the SIM Binding Direction dated 28 November 2025.

Internet Freedom Foundation, letter to DoT, December 12, 2025

Non-compliance, IFF noted, is a platform problem, not a user fine: Rule 9 of the cyber security rules points to the Act, which sets a civil penalty up to ₹25,000 and then up to ₹50,000 for every further day the breach continues. The foundation also warned that a constant SIM-to-app link is a location and usage trail by another name, sitting next to the state’s power to call for data from fiduciaries.

Banking and UPI apps already bind to a live SIM. DoT’s December 2025 note presents the chat order as that same tool, extended. The Securities and Exchange Board of India has even proposed SIM-binding for trading accounts. Chat is not a payments rail. It is how families, schools and kirana shops talk, and the copy-paste from UPI is the part privacy lawyers keep contesting.

WhatsApp’s Android Beta Already Polls the SIM

The November 2025 text and the April 2026 parliamentary reply are not the same document. Platforms still have to build against a live-SIM duty. The six-hour web logout, which would have dumped every WhatsApp Web shopkeeper four times in a workday, is the piece the government publicly eased.

WHAT CHANGED AFTER INDUSTRY PUSHBACK

Pemmasani put the new clocks on the Rajya Sabha record in a written reply.

The government has issued directions to certain app-based communication service providers to link the SIM card (associated with the mobile number used for identification of customers/users or for provisioning or delivery of services) present in the device of the customer/user with the communication service apps concerned and has specified the timeframe for compliance with the same as December 31, 2026.

Pemmasani Chandra Sekhar, Minister of State for Communications, Rajya Sabha written reply, April 2, 2026

IFF flagged that the climbdown on six-hour logouts was described in news briefings and in that reply, not in a fresh published direction, and said the original order had been written without a public consultation after telco lobbying.

As reported by The Economic Times and the Hindu today, the Government is not planning to enforce the SIM-binding rules as originally stated. The forced 6 hour logouts from WhatsApp Desktop has been dropped.

Sim Binding Directions were made unilaterally and without any… pic.twitter.com/vZeYkxtUOl

— Internet Freedom Foundation (IFF) (@internetfreedom) April 2, 2026

WhatsApp has been building the remaining half. Feature tracker WABetaInfo saw a check in Android beta 2.26.8.6 in February 2026: the app confirms the registered SIM is still in the phone, and if the check fails access is restricted while chat history stays on the device. Meta has said it is testing the behaviour with regular users in India. Exact lockouts will still differ by app, and Signal’s public silence on the notice has not been filled by a DoT update.

January 1 Will Not Flip a Master Switch

Officials have said accounts will not all stop on the compliance date. Enforcement follows whether each platform has actually shipped the check. A one-phone user who already keeps the WhatsApp number’s SIM in that phone should see little change. Roaming with that same card in the handset is the case DoT carved out in December 2025.

The first-day noise treated January 1, 2027 as a national kill switch. That is not what the minister put on the record, and it is not how a staged app rollout works. The sharper change is smaller and more physical: the Indian number on a chat app stops being a password you proved once, and becomes a card that has to stay in the device that is allowed to talk.

Whitefield’s ten boxes were already doing that, 32 cards at a time. The accounts that have to plan are the ones that currently chat with the registered SIM in another room, in a bag at the airport, or in no slot at all.