India has given messaging services until Dec. 31, 2026, to ensure accounts tied to Indian mobile numbers work only when the associated active SIM is in the device, a rule aimed at curbing fraud.
The Department of Telecommunications (DoT) issued the directions on Nov. 28, 2025, under the Telecommunications (Telecom Cyber Security) Rules, 2024. Its announcement named WhatsApp, Telegram, Signal, Snapchat, Arattai, Sharechat, Josh and Jiochat, and covered communication apps that use Indian mobile numbers to identify users or provide services. The original timetable called for implementation within 90 days and compliance reports within 120 days.
In an April 2, 2026, written reply to the Rajya Sabha, Minister of State for Communications and Rural Development Dr. Pemmasani Chandra Sekhar set Dec. 31, 2026, as the compliance date. DoT said the requirement targets fraud involving Indian numbers. The department said some accounts remain usable after their SIM is removed or deactivated; separately, it said fraudsters have operated accounts using Indian numbers from abroad. DoT cited cyberfraud losses of more than ₹22,800 crore in 2024.
DoT said roaming users are not affected as long as the associated SIM stays in the handset. Under the directions, a covered app must not operate without that SIM installed in the device running it.
Government instructions for web use differ. DoT’s December 2025 announcement required browser sessions to end within six hours and provided for QR-code reconnection. In the April reply, Sekhar said logout timing should be set through risk analysis and gave no fixed interval.
Business Standard reported on Dec. 16, 2025, that the Internet and Mobile Association of India warned required browser logouts could interrupt work at businesses that rely on web messaging, including small and medium enterprises. EconoTimes previously covered business doubts about the mandate’s security benefits.
The ministry’s reply does not give a date for when users should first see the changes. It identifies Dec. 31, 2026, as the point by which covered services must comply.
