SIM binding is approaching a decisive implementation deadline in India, but new survey evidence suggests that small businesses and consumers remain unconvinced that linking messaging accounts to physical SIM cards will make digital platforms safer. The findings expose a central tension in the policy: the government is trying to improve traceability, while users and businesses are concerned that the measure may not address the most common routes through which online fraud takes place.
A survey of 353 businesses across 17 cities by technology policy think tank Esya Centre found that 87.2% were worried about fraud linked to SIM cards. Yet 81% said SIM binding would not offer security benefits. In a separate survey of 2,033 consumers across 18 cities, 59.2% also said the measure would not make messaging platforms safer. Both surveys were conducted between February and April 2026.
The results arrive two months before the December 31 deadline for messaging applications to comply with the SIM-binding directions. The rules are scheduled to take effect from January 1. The initial deadline had been set for the end of February 2026, but was extended until December 31 following requests from companies, according to the supplied report.
That timing matters because the policy is not simply a new identity requirement. It changes how app-based communication services are expected to function across phones, web browsers and other linked devices. Under the directions, messaging accounts must remain linked to the physical SIM card associated with the mobile number used to identify the user. The application should not work if that specific active SIM is not present in the device.
For users accessing messaging services through a web version, the rules require sessions to be logged out at least once every six hours. Users must then be allowed to reconnect by scanning a QR code. The framework applies to app-based communication services in India, including WhatsApp, Telegram, Signal, Arattai, Snapchat, ShareChat, JioChat and Josh, according to the report.
The Department of Telecommunications has said that some applications allow people to continue using a service even when the SIM card linked to their mobile number is not in the phone. The department’s stated concern is that this feature is being misused to commit cyber frauds by entities located abroad. From the government’s perspective, forcing the account and the active SIM to remain together is intended to improve traceability and reduce the ability to operate accounts remotely or anonymously.
The survey findings, however, raise a different question: whether the location and presence of the SIM card are the main weaknesses in the fraud chain. The Esya Centre report argued that much online fraud takes place through phishing, stolen passwords, malware and hijacked sessions. SIM binding does not directly address those methods. An account may remain connected to the correct SIM and still be compromised if a user is deceived into sharing credentials, installs malicious software or loses control of an existing session.
This distinction is important for urban India, where messaging applications have become part of the everyday operating system of small businesses. Firms use them to communicate with customers, receive orders, coordinate workers, share payment information and manage suppliers. A security measure that improves one form of traceability but does not address the wider range of account-compromise methods may be seen by users as adding friction without delivering equivalent protection.
The supplied report also cites an Indian School of Business study that found gaps in the process of issuing SIM cards. Telecom companies do not always verify details provided by buyers against government databases such as Aadhaar, and agents sometimes skip identity checks while issuing SIMs, according to the report. If those weaknesses persist, the physical SIM itself cannot be treated as an unquestionable identity anchor.
That creates an institutional problem for the policy. SIM binding assumes that the mobile number and the SIM associated with it provide a reliable basis for identifying the user. But if identity checks at the point of SIM issuance are inconsistent, binding an account to a SIM may establish a connection to a telecom credential without conclusively establishing who is operating the account. The measure could therefore strengthen a traceability mechanism while leaving vulnerabilities in the identity system beneath it.
The distinction between traceability and security is at the centre of the debate. Traceability can help investigators establish which number or device was associated with an account at a given time. Security requires preventing unauthorised access, deception and misuse in the first place. The survey responses suggest that many businesses and consumers do not believe the proposed technical link will substantially improve the second objective.
The rules also have an operational dimension. Of the businesses surveyed, 83.5% said delays and mistakes would become likely after implementation. About 41% of consumers said they would consider buying an extra SIM card. These figures record expectations rather than outcomes, and the report does not establish that such disruptions have already occurred. They nevertheless show where implementation anxiety is concentrated: continuity of access, device changes, web logins and the possibility that users may seek workarounds.
For small firms, the practical consequences could be more significant than for users who treat messaging as a personal service. A missed message, interrupted web session or failed relinking process can affect customer communication and internal coordination. The six-hour logout requirement is particularly relevant to businesses that use desktop or browser-based interfaces for extended periods. The supplied material does not quantify the number of firms that depend on such workflows, but the survey indicates that businesses expect mistakes and delays to be a major concern.
Messaging companies have raised similar implementation concerns. The industry has pushed back against the directive, arguing that continuous SIM binding across multiple devices and web logins would require substantial changes to app architecture and coordination with operating system providers. These concerns show that the policy is being implemented not only through user-facing rules but also through a technology ecosystem involving application developers, mobile operating systems and telecom networks.
The regulatory framework comes from the Telecom Cyber Security Rules, under which the SIM-binding directions were issued in November 2025. The Department of Telecommunications is therefore using telecom-sector powers to shape the operating conditions of app-based communication services. That approach reflects the fact that digital fraud often crosses institutional boundaries: the relevant account may belong to a messaging platform, the number may be issued by a telecom company, the device may be controlled by an operating system provider and the victim may be located in another city or country.
A policy spanning these layers requires coordination that cannot be achieved through a single app setting. The directions place immediate compliance responsibilities on messaging platforms, but the report’s reference to SIM verification gaps points to responsibilities elsewhere in the chain. Telecom operators and their agents control the issuance process, while operating system providers influence device-level access and account security. The effectiveness of SIM binding will therefore depend on how consistently these actors implement their respective controls.
The numbers in the two surveys also reveal a perception gap between businesses and consumers. Businesses reported higher concern about SIM-related fraud, at 87.2%, while 81% rejected the security benefits of SIM binding. Among consumers, 59.2% did not believe the measure would make messaging platforms safer. The surveys were conducted across 17 and 18 cities respectively, but the supplied material does not provide a city-wise breakdown or explain how the samples were selected. The findings should therefore be read as reported perceptions rather than a complete measure of nationwide behaviour.
Even with that limitation, the results point to a broader governance challenge. Cybersecurity rules are often assessed by whether they can be enforced technically, but public acceptance also depends on whether users can see a credible connection between compliance and protection. If people experience repeated logouts, device restrictions or additional SIM requirements without a clear reduction in phishing, malware or account hijacking, confidence in the policy may weaken.
The central issue is not whether traceability has value. The Department of Telecommunications has identified a specific vulnerability in accounts being used without the linked SIM being present in the device. The more difficult question is whether that vulnerability is sufficiently central to online fraud to justify the operational burden imposed across all covered services. The survey evidence supplied by the Esya Centre indicates that many businesses and consumers do not yet see that connection.
The December 31 compliance deadline will bring that debate into practical focus. The next phase will show how messaging platforms implement continuous SIM presence, six-hour web-session logouts and QR-based relinking, and whether telecom identity checks become more reliable. It will also establish whether the policy functions primarily as an investigative traceability tool or delivers the broader security improvement users expect. For now, the evidence confirms a clear mismatch between regulatory intent and user confidence, while leaving the measure’s real effect on fraud unresolved.
