The debate over SIM binding in India is becoming less about whether messaging accounts can be technically linked to mobile numbers and more about whether that link addresses the main ways online fraud actually occurs. A survey of 353 small businesses across 17 cities found that 87.2% were concerned about SIM-related fraud, while 81% did not believe SIM binding would provide security benefits. A separate survey of 2,033 consumers across 18 cities found that 59.2% also did not think the measure would make messaging platforms safer.
The findings, reported by the Esya Centre, arrive ahead of the December 31, 2026 deadline for messaging platforms to comply with the Department of Telecommunications’ SIM-binding directions. The rules will take effect from January 1 and require messaging accounts to remain linked to an active physical SIM card associated with the user’s mobile number. Web sessions must also be logged out at least once every six hours.
That creates a clear policy tension. The government’s objective is traceability: ensuring that a person using an app-based communication service can be connected to a functioning mobile number and an active SIM card. The survey evidence, however, suggests that many businesses and consumers distinguish between identifying a mobile connection and preventing fraud. The measure may establish an additional condition for accessing an account without necessarily addressing the methods used to compromise it.
The Esya Centre report attributed much online fraud to phishing, stolen passwords, malware and hijacked sessions. These are different pathways from simply using an account on a device that does not contain the linked SIM. If an individual is deceived into surrendering login credentials, or if a device or session is compromised, requiring a physical SIM to remain present may not directly eliminate the underlying vulnerability identified in the report.
This distinction matters because the policy is being implemented across a large and diverse digital communications environment. The directions apply to companies providing app-based communication services in India, including WhatsApp, Telegram, Signal, Arattai, Snapchat, ShareChat, JioChat and Josh. These services operate across smartphones, computers and other linked devices, making the relationship between a mobile number, an active SIM, an account and a web session operationally significant.
Under the directions, an app must ensure that the SIM card is in the device and connected to the mobile number used to identify the user. The app should not work without that specific and active SIM. Where a web version exists, users must be logged out regularly, no later than every six hours, and allowed to link the device again by scanning a QR code.
The six-hour web-session requirement illustrates how a traceability objective can become a recurring user-side process. A consumer or small business employee using a desktop browser may need to re-establish access repeatedly. The rule does not, by itself, establish how businesses with multiple employees, shared devices, changing work locations or several linked devices will manage those sessions. The survey recorded expectations rather than measured post-implementation outcomes, but 83.5% of the businesses surveyed said delays and mistakes were likely to increase.
The potential burden is especially relevant for small firms. Unlike large companies, small businesses may have limited administrative capacity to manage account recovery, device linking and access interruptions. Messaging platforms are often used for customer communication, order coordination and internal operations, but the supplied report does not quantify how many firms depend on these functions or how much disruption would result. What it does show is that respondents anticipate operational problems before the deadline takes effect.
The consumer survey points to another possible response. About 41% of consumers said they would consider buying an extra SIM card. This is an expectation, not evidence that additional SIM purchases have already occurred. It nevertheless indicates that users may adapt to the rule by separating numbers or acquiring more connections, potentially complicating the idea that a physical SIM provides a simple and stable identity signal.
The report also raises questions about the reliability of the mobile identity layer on which SIM binding depends. It cited a study by the Indian School of Business that found telecom companies do not always verify details provided by SIM buyers against government databases such as Aadhaar. It also said that agents sometimes skip identity checks while issuing SIM cards. If the initial identity verification process is incomplete or inconsistent, linking an account to a SIM may provide traceability to a connection without necessarily guaranteeing that the person using it is accurately identified.
That is the institutional issue at the centre of the policy. SIM binding places responsibility on app-based communication companies to enforce a condition rooted in telecom identification. Its effectiveness therefore depends on several actors: the Department of Telecommunications, telecom operators, app companies, operating system providers and users. The rules assign a compliance function to the apps, while the report’s evidence also points to weaknesses at the stage when SIMs are issued.
The industry’s objections have focused on implementation. Messaging platforms have said that continuous SIM binding across multiple devices and web logins would require significant changes to app architecture and coordination with operating system providers. The pushback led to the original February-end 2026 deadline being extended to December 31, 2026, following requests from companies, according to the report.
The extension changes the immediate policy question from whether companies can comply at all to how compliance will be experienced by users. The directions seek to prevent apps from functioning when the linked SIM is absent from the device, particularly in cases where accounts may be used from outside India. The government has said some apps allowed users to continue accessing services even when the SIM linked to the mobile number was not in the phone, and that this was being misused for cyber fraud by entities located abroad.
The supplied evidence does not establish how many fraud cases would be prevented by enforcing the rule, nor does it provide post-implementation data. It also does not show whether the technical objections raised by platforms have been resolved. The surveys were conducted between February and April 2026, before the January 1 enforcement date, so their findings capture perceptions and expected effects rather than observed outcomes under the final system.
That limitation is important. A survey finding that 81% of businesses do not expect security benefits cannot prove that SIM binding will have no security value. It shows a significant gap between the policy’s intended mechanism and the way surveyed businesses understand their security risks. Similarly, the consumer response indicates scepticism, but not whether users will ultimately experience fewer compromised accounts or fraud attempts.
The evidence instead supports a narrower conclusion: SIM binding targets one specific account-access condition, while the reported fraud mechanisms are broader. Phishing, credential theft, malware and hijacked sessions require security responses that may involve user awareness, account protection, device security, session management and stronger identity controls. The Esya Centre report argues that fixing weaknesses in SIM issuance and identity checks could do more to reduce fraud, but the supplied material does not detail a replacement framework or compare the effectiveness of different interventions.
For cities, the question extends beyond app settings. The surveys cover businesses and consumers across multiple urban locations, placing the policy within the everyday digital infrastructure of urban commerce. Messaging platforms now form part of how small firms communicate with customers and organise work, while mobile connections function as gateways to financial, commercial and civic activity. A rule that changes access conditions can therefore create operational effects even when its formal subject is telecom and platform security.
The December 31 deadline and January 1 implementation date will provide the next test of the policy. The developments that deserve attention are whether platforms can enforce continuous SIM presence without widespread access failures, whether web users face repeated disruption, whether businesses report the anticipated delays and mistakes, and whether authorities publish evidence of reduced fraud. Until those outcomes are available, the surveys establish substantial concern about SIM-related fraud and broad scepticism about SIM binding, but they do not settle whether the measure will improve digital safety in practice.
