The debate over SIM binding is moving beyond whether messaging platforms can technically comply with the rule. A survey of 353 small businesses across 17 cities found that 87.2% were concerned about SIM-related fraud, but 81% did not believe that linking messaging accounts to physical SIM cards would make platforms safer. The finding points to a central problem in India’s cyber-governance approach: a measure designed to improve traceability may not address the methods through which many frauds actually occur.
The survey, conducted by tech policy think tank Esya Centre between February and April 2026, comes ahead of the December 31 deadline for covered applications to comply with SIM-binding directions. The rules are scheduled to take effect from January 1. The requirements apply to app-based communication services in India, including WhatsApp, Telegram, Signal, Arattai, Snapchat, ShareChat, JioChat and Josh.
The policy was issued under the Telecom Cyber Security Rules in November 2025. The Department of Telecommunications has said some applications allowed users to continue using services even when the SIM card linked to their mobile number was not present in the device. According to the department, this was being misused for cyber fraud by entities located abroad.
Under the directions, a messaging account must be linked to the physical SIM card connected to the mobile number used to identify the user. The application is not supposed to work without that specific and active SIM. Where a web version exists, users must be logged out at least once every six hours and allowed to reconnect by scanning a QR code.
The policy therefore treats the continuing presence of the SIM card as an important control point. Its intended benefit is traceability: if an account is tied to a SIM that must remain in the device, investigators may have a clearer connection between the account and the mobile number. But the Esya Centre report argues that this connection does not necessarily prevent the techniques used to obtain access to accounts or deceive victims.
It identifies phishing, stolen passwords, malware and hijacked sessions as major pathways for online fraud. None of these methods necessarily depends on the absence of a SIM card from the user’s device. A person can be tricked into disclosing credentials, have malicious software installed or lose control of an active session even when the account remains linked to a physical SIM.
This distinction matters because traceability and prevention are not the same thing. SIM binding may make one aspect of account identification more difficult to evade, but the survey evidence suggests that businesses do not see it as a direct remedy for the wider set of weaknesses through which fraud takes place. The policy’s effectiveness will therefore depend on what problem it is intended to solve and how its results are measured.
The report also raises questions about the reliability of the identity chain behind a SIM card. It cited a study by the Indian School of Business which found that telecom companies often do not verify details provided by SIM buyers against government databases such as Aadhaar. It further said that agents sometimes skip identity checks while issuing SIM cards.
If those gaps persist, the physical SIM itself cannot automatically serve as a dependable proxy for the identity of the person using an account. The rule may establish a technical link between an application, a mobile number and a device, while leaving unresolved whether the original subscriber information is accurate or whether the person using the account is the legitimate user.
That creates an institutional question involving more than messaging companies. The Department of Telecommunications is setting the compliance framework, but telecom operators and their agents control important parts of the subscriber-registration process. Messaging platforms must modify their applications and web services, while operating-system providers may be involved in how devices detect SIM presence and manage permissions. The policy’s outcome will depend on coordination across this chain.
The business survey indicates that implementation itself could create operational costs. About 83.5% of the businesses surveyed said delays and mistakes were likely to become more common. These figures describe expectations, not observed outcomes. Even so, they identify the practical pressure points of a rule that could interrupt access to business communication, particularly where firms rely on multiple devices, web logins or shared operational accounts.
The requirement to log out web sessions at least once every six hours is especially significant for everyday workflows. Businesses using messaging applications for customer support, sales, delivery coordination or internal communication may have to reconnect repeatedly. The supplied report does not establish how many firms will face material disruption, but it records a broad expectation that errors and delays could increase.
The consumer survey offers a similar warning about adaptation. Among 2,033 consumers across 18 cities, 59.2% said SIM binding would not make messaging platforms safer. About 41% said they would consider buying an additional SIM card. This is again an expectation rather than evidence that consumers have already changed their behaviour. However, it shows how a security rule can generate workarounds if users perceive the compliance burden as high or the safety benefit as unclear.
An additional SIM could help a user manage separate personal, work or device arrangements, but it could also complicate the relationship between identity, account access and mobile numbers. The survey does not establish whether additional SIM purchases would increase fraud or whether platforms could reliably distinguish legitimate multi-device use from suspicious activity. Those questions remain unresolved in the supplied evidence.
The policy’s history already reflects implementation difficulty. The initial deadline for SIM binding was February-end 2026. It was later extended to December 31, 2026, following requests from companies. The extension indicates that platforms raised practical concerns about enforcing continuous SIM binding across multiple devices and web logins, and about the changes required in application architecture and coordination with operating-system providers.
This is not simply a question of whether companies can add another verification step. The direction changes how messaging services authenticate users, maintain sessions and support access across devices. It also affects the balance between convenience and control. A service that allows a user to work through a web interface without keeping a particular SIM in the device is being asked to impose a recurring physical-presence condition.
The institutional design also leaves measurement as a crucial issue. The supplied material explains the rule’s traceability objective and records concerns about phishing, stolen passwords, malware and hijacked sessions, but it does not provide post-implementation data showing which forms of fraud the measure has reduced. It also does not establish whether the six-hour logout requirement will improve investigations, reduce account takeovers or simply increase reconnection activity.
That evidence gap makes the January start date more than a compliance milestone. It will begin a test of whether a telecom-linked control can produce meaningful security gains inside services whose vulnerabilities often arise from user deception, compromised credentials and malware. The test will require a clear distinction between accounts that are easier to trace and fraud that is actually prevented.
For citizens and small firms, the practical question is not only whether an account is linked to a SIM. It is whether the combined system makes it harder for criminals to impersonate users, capture credentials, hijack sessions and operate through weak identity checks. The Esya Centre findings suggest that many users and businesses currently see a mismatch between the rule’s mechanism and the threats they experience.
The evidence does not establish that SIM binding will fail. Nor does it show that the rule has already caused the delays, mistakes or additional SIM purchases anticipated by respondents. It does establish a broad perception among surveyed businesses and consumers that the security benefits are limited, alongside specific concerns about implementation and the quality of SIM-user verification.
The next stage will be shaped by the December 31 compliance deadline and the January 1 effective date. The important developments to monitor are how covered platforms implement the physical-SIM requirement, how web-session logouts affect users and businesses, whether telecom identity checks are strengthened, and whether authorities publish evidence linking the measure to reductions in the fraud methods identified in the report.
