SIM binding rule India: 31 Dec 2026 deadline, what app developers must build

Summary. India's Department of Telecommunications (DoT) issued SIM binding directions on 28 November 2025 under the Telecom Cyber Security Rules, 2024, as amended in October 2025. App-based communication services that identify users by an Indian mobile number must stay continuously linked to that number's SIM in the device; the original text also required web logout at least every 6 hours, with 90 days to implement. Eight services were named: WhatsApp, Telegram, Snapchat, Arattai, ShareChat, Josh, JioChat and Signal. On 2 April 2026 the government told the Rajya Sabha in a written answer that compliance is due by 31 December 2026 and that web sessions are to be logged out on a risk basis, with no fixed interval. That date is 60 days from 1 November 2026. No revised written direction has been published, and only press reports name 1 January 2027 as the start date. The work: bind the account to the SIM at sign-up, detect SIM changes, risk-score web sessions, and handle eSIM, dual-SIM and roaming. Android exposes SIM-change signals; iOS 26 and 27 add Core Telephony checks that Apple ties to a UPI entitlement.

About this article. For product, mobile and security teams at Indian apps with phone-number login. On 1 November 2026 we checked regulatory claims against the PIB release, DoT's PDF copy, the direction text and two Rajya Sabha written answers, and technical claims against Android, Google Play and Apple documentation; press reports are labelled as such. General information, not legal advice; no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

Status check: what is confirmed and what is only reported

The extension and the logout change now rest on a primary record: the written answer to Rajya Sabha Unstarred Question 4331, given on 2 April 2026 by Dr Pemmasani Chandra Sekhar, Minister of State for Communications and Rural Development. It sets compliance at 31 December 2026 and says web sessions are to be logged out on a risk basis, with no fixed period. What is missing is a revised written direction. The November 2025 text still says 6 hours, MediaNama reported on 16 October 2026 that none had been issued, and we found no PIB or DoT notice by 1 November 2026. The original release is on PIB, with a PDF copy on the DoT site. The table also draws on the direction text and press reports.

Treat 31 December as firm. DoT will probably accept risk-based logout, but get that in writing: the only written direction you can show an auditor still says 6 hours. IFF notes the direction was never published or put to public consultation; the government told the Rajya Sabha it began consulting major operators in February 2025.

What the DoT direction requires

PIB lists two obligations. First, the service must stay continuously linked to the SIM in the device that carries the identifying mobile number, so the app cannot be used without that specific, active SIM. Second, any web instance must be logged out periodically, originally within 6 hours, with QR re-linking.

The text MediaNama reproduced adds three details:

• It is addressed to a class, not only eight companies. It directs all TIUEs providing app-based communication services that use mobile numbers to identify customers or deliver services in India, as does the PIB subtitle.

• It relies on the TIUE definition. A Telecommunication Identifier User Entity is anyone other than a licensee that uses telecom identifiers to identify customers or deliver services. The October 2025 amendment created that category, a Mobile Number Validation (MNV) platform TIUEs can be directed to use, and Rule 5 powers to make TIUEs suspend specific numbers without notice.

• It stays in force until DoT amends or withdraws it. Non-compliance attracts action under the Telecommunications Act, 2023. IFF reads this as a civil penalty of up to ₹25,000, then up to ₹50,000 for each day the contravention continues.

DoT's stated reason: accounts keep working after the SIM is removed or taken abroad, and long-lived web sessions let fraudsters operate from outside India. It cited cyber-fraud losses above ₹22,800 crore in 2024; the I4C figure is ₹22,811.95 crore from 19.18 lakh complaints.

How the timeline moved in 2026

Sources: AZB, PIB, PTI, WABetaInfo, ETV Bharat, the Rajya Sabha answer and MediaNama.

A DoT official told the Hindustan Times the delay came from testing and operating system updates, per MediaNama, and tele.net reported that platforms expected to be technically ready only by October to November 2026. Per MediaNama on 23 October, WhatsApp and Arattai say they are building compliance features, Signal had not responded to notices (per CNBC), Telegram had not clarified, and Snapchat says the rule does not apply because phone numbers are not its primary identifier.

Who is in scope: messaging, social, banking and UPI

Messaging and calling apps that register users with a +91 number are the direct target. A chat, calling or community product with phone-number login should assume the class wording covers it and get a legal view.

Social apps with messaging, such as ShareChat and Josh, were named. The open question is whether the phone number identifies the user or only recovers the account. Snapchat argues phone numbers are not its primary identifier; do not assume that argument wins.

Banking and UPI apps are not the subject of this direction. UPI apps already bind devices under NPCI's framework, and PIB cites banking and UPI as the precedent. They are TIUEs under the amended rules, though, so they can be directed to the MNV platform and served Rule 5 suspension orders. They can also use DoT's Financial Fraud Risk Indicator, which classes a number as medium, high or very high risk of financial fraud. UPI teams face a second deadline on the same date, NPCI's 30% market-share cap, covered in our UPI 30% cap playbook for fintechs.

Technical implementation options

Prove the SIM is present at sign-up

There are three patterns, in order of strength.

1. Device-originated SMS (the UPI pattern). In Juspay's UPI flow, the payment service provider supplies a virtual mobile number (VMN) and SMS content, the phone sends the message, and the receiving aggregator calls the provider back to match the sender to the registered number. Because the SMS leaves from that phone's SIM, it proves presence at that moment. Silent sending on Android needs SEND_SMS, which Google Play allows only for listed uses such as SMS-based financial transactions, with UPI as the example. A messaging app should instead open the SMS app with an ACTION_SENDTO intent, so the user taps Send. On iOS, MFMessageComposeViewController likewise lets the user edit the message and sends only when they confirm.

2. Carrier-verified number. Android's Phone Number Verification API, part of Credential Manager's digital credentials support, fetches an encrypted GSMA TS.43 token by authenticating the SIM, and your backend exchanges it with an aggregator or carrier for the verified number. Google says it checks the physical SIM or eSIM active on the device. Confirm Indian coverage with your aggregator: in October 2025 Airtel, Jio and Vodafone Idea said they had launched a SIM Swap API and planned a CAMARA-based Number Verification API before the end of 2025. For UPI, The Paypers reports that NPCI circular OC-238 recognises silent mobile verification as an additional device-binding method, to be used alongside SMS binding rather than instead of it.

3. Inbound SMS OTP. This is the weakest proof, because a code read on one device can be typed on another. The SMS Retriever API helps by reading the code on the receiving device without SMS permissions. WABetaInfo reports that WhatsApp's beta asks for a fresh 6-digit code to confirm the registered SIM, and that a passkey will not satisfy that check. That is a rare case where SMS beats passkeys; our passkeys versus SMS OTP guide covers where each one fits.

Detect SIM removal or change afterwards

Android. You can read SIM state, the list of active subscriptions (with READ_PHONE_STATE, a runtime permission) and a callback when subscriptions change. You cannot read the SIM serial (ICCID) or IMSI. Since Android 10, getSimSerialNumber() and getSubscriberId() need READ_PRIVILEGED_PHONE_STATE, which apps installed from Google Play cannot declare (apps with carrier privileges are exempt). So the app can tell that a SIM is present or that something changed, not that it is the same SIM; use the signal to trigger server-side re-verification. In code, the Executor overload of addOnSubscriptionsChangedListener needs API 30, and the callback also fires once when you register, so compare against the last snapshot instead of re-verifying on every launch. The active subscription list can be null before Android 15 (API 35), and is empty whenever no SIM is active.

            // Needs READ_PHONE_STATE; the Executor overload needs API 30+.
fun watchSims(context: Context, onChange: () -> Unit): SubscriptionManager.OnSubscriptionsChangedListener? {
    val tm = context.getSystemService(TelephonyManager::class.java)
    val sm = context.getSystemService(SubscriptionManager::class.java) ?: return null
    if (tm?.simState != TelephonyManager.SIM_STATE_READY) onChange()

    var last: Set<Int>? = null // persist to catch changes while the app was closed
    val listener = object : SubscriptionManager.OnSubscriptionsChangedListener() {
        override fun onSubscriptionsChanged() {
            // Also fires once on registration, so compare first.
            val now = sm.activeSubscriptionInfoList.orEmpty().map { it.subscriptionId }.toSet()
            if (last != null && now != last) onChange()
            last = now
        }
    }
    sm.addOnSubscriptionsChangedListener(context.mainExecutor, listener)
    return listener // call removeOnSubscriptionsChangedListener when done
}
          

iOS. Apple deprecated CTCarrier in iOS 16 with no replacement, but Core Telephony now has a narrower tool, CTCellularPlanStatus.

• UPI-style SIM check (iOS 26). An SMS sent through the compose sheet configured for UPI device validation yields a token tied to the sending SIM's ICCID, which the app must fetch within 30 seconds; checkValidity(ofToken:) later reports whether that SIM is still present and switched on. That is real SIM-presence detection, but it needs the com.apple.developer.upi-device-validation managed entitlement, which Apple grants on request for UPI device enrolment for NPCI transactions.

• Phone-number hint (iOS 27). Once the user allows checks for a number, getHintForPhoneNumber says whether the device appears to have an active cellular plan for it, with high or low confidence. The permission request can also return not supported. Apple's entitlement page says the UPI entitlement is needed for CTCellularPlanStatus and does not say whether messaging apps can use the hint without it, so ask Apple first.

MediaNama, citing CNBC, reported on 23 October 2026 that Apple had made the changes needed for SIM binding; we found no Apple statement linking these APIs to the DoT direction. Until that is clear, plan on periodic re-verification plus server-side SIM swap checks, and use the iOS 27 hint as an extra signal where you can.

Server side. Bind each install to a hardware-backed key (Android Keystore, iOS Secure Enclave) and check Play Integrity or App Attest, so a copied token fails elsewhere. SIM binding shows the number is present; device binding shows it is the same phone. You need both, plus the wider hardening in our mobile application security guide.

Multi-device, web and desktop sessions

The direction text says 6 hours; the government's stated position in Parliament is risk-based logout with no fixed interval. PTI's sources described the risk analysis as AI-enabled and run by the platforms, and tele.net reported that sessions must end immediately where fraud is suspected. Build for both readings:

• A companion-session lifetime held in remote config, so you can move between 6 hours and longer without an app release.

• Risk triggers that end companion sessions at once: a failed SIM check or subscription change on the primary phone, a new device link, a spike in failed attempts, or a fraud report.

• Trust inherited from the primary phone: tokens refresh only while it passes its SIM check, and QR re-linking needs it with a valid SIM.

            # Illustrative companion-session policy, not DoT text
companion_session:
  max_ttl_hours: 6            # raise only with written DoT confirmation
  refresh_requires_primary_sim_check: true
  force_logout_on:
    - primary_sim_check_failed
    - primary_subscription_changed
    - new_companion_linked_unrecognised
    - failed_auth_attempts_gt: 5
    - fraud_report_received
  relink: qr_from_primary_with_valid_sim
          

eSIM, dual-SIM, roaming and Wi-Fi

• Accept the registered number in either slot. The direction speaks of the SIM installed in the device, not a particular slot.

• Support eSIM. Android's carrier verification covers eSIM. CNBC's claim that WhatsApp and Telegram will need a physical SIM is unclear, and users pointed out that some iPhones have no SIM tray at all.

• Do not block roaming users. PIB says roaming is unaffected while the SIM stays in the handset, so a foreign IP address alone is not a failure.

• Plan for Wi-Fi. Silent mobile verification runs over the operator's data network, so keep an SMS fallback for phones on Wi-Fi only.

Implementation by app type

Rule drivers below come from the PIB release, the Rajya Sabha answer and Google Play policy.

Worked example: re-verification load

Illustrative assumptions, not measurements: an app with 5 million monthly active Indian accounts.

• Re-verification every 30 days: 5,000,000 ÷ 30 = about 166,667 checks a day.

• Event-driven checks: if 2% of users change SIM or phone each month, that adds 100,000 checks a month, or about 3,333 a day (100,000 ÷ 30).

• Day-one backfill: re-verifying everyone within 7 days means 5,000,000 ÷ 7 = about 714,286 checks a day that week.

• Fixed 6-hour web cap: 1 million users on web through an 8-hour working day need 8 ÷ 6 = 2 sessions (rounded up), and yesterday's session has expired by morning, so each scans a QR code at least twice a day: 2 million QR links a day. Risk-based logout should remove most of these.

Multiply these volumes by the per-check price in your aggregator contract, and size rate limits for the backfill week.

User-experience impact

Users with one phone and one SIM should see little beyond an occasional prompt. The pain sits elsewhere:

• Shared numbers. A CUTS International survey reported by PTI found about 86% of users let family use their phone or SIM for messaging, and in 39% of those cases the SIM holder may not be nearby when authentication is needed; 80% of consumers and over 60% of small and medium businesses expected disruption.

• Travellers and NRIs. IFF warns that users who switch to a local foreign SIM may lose access unless the Indian SIM stays active in the device.

• Businesses on web messaging. An Esya Centre survey of 2,033 consumers and 353 small businesses, reported by MediaNama, found that 82% of the businesses expect forced logouts to disrupt operations. Its fieldwork ended before the 6-hour rule was dropped.

• Second phones and tablets that never held the SIM lose standalone access.

Design for it: warn users weeks ahead, show which number the account uses, make change-number easy, keep chat history intact while access is restricted (WhatsApp's approach, per WABetaInfo), explain each failure plainly, and never send verification links by SMS.

DPDP, Google Play and App Store notes

SIM state, subscription IDs, device keys and IP-based risk signals are personal data once linked to an account. Collect only what the check needs, state the purpose, set retention limits, and keep risk inputs auditable. Our DPDP Act engineering playbook covers the controls.

On Google Play, declare the device and phone-number data you collect in the Data safety form, and request SEND_SMS only if you qualify for an exception. From 27 January 2027, Play will no longer accept phone-call account verification as a use for READ_CALL_LOG, pointing developers to the Digital Credentials or SMS Retriever APIs, so skip a call-log fallback. On iOS, update privacy labels, avoid private APIs, and request the UPI entitlement only for a UPI app.

Compliance checklist

1. Get a legal view on whether your app is a TIUE providing an app-based communication service.

1. Ask DoT, through counsel or an industry body, to confirm risk-based logout in writing.

1. Map every place the phone number identifies a user, delivers a service or recovers an account.

1. Choose sign-up binding (SMS via intent, carrier verification or both) with a Wi-Fi fallback.

1. Ship SIM-change detection on Android; on iOS, test the iOS 27 hint, ask Apple about entitlement scope, and keep periodic re-verification.

1. Add hardware-backed device binding with Play Integrity or App Attest.

1. Put companion sessions on a configurable lifetime with risk-based logout, and make QR re-linking depend on the primary device passing its SIM check.

1. Test eSIM, both SIM slots, roaming, airplane mode and no-network cases.

1. Build restricted mode, change-number and appeal flows, plus support scripts and a 24x7 runbook for Rule 5 suspension orders.

1. Update privacy notice, DPDP records, Play Data safety and App Store labels.

1. Log when each check ran and why each session ended, then draft the compliance report: method, coverage and exceptions.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our AI and mobile application development services team builds SIM binding into Android, iOS and Flutter apps, from sign-up checks to session policy and compliance evidence. Talk to us at /contact-us/.

Last updated: 1 November 2026.

References

1. DoT's directions for SIM binding for prevention of misuse of telecommunication identifiers, 1 December 2025 — Press Information Bureau

1. Govt orders WhatsApp, Telegram to bind SIMs within 90 days (with full text of the directions), 29 November 2025 — MediaNama

1. Rajya Sabha Unstarred Question No. 4331, SIM binding regulation, answered 2 April 2026 — Rajya Sabha, Department of Telecommunications

1. Survey finds SIM binding may disrupt business, but will it stop fraud?, 16 October 2026 — MediaNama

1. WhatsApp, Telegram SIM-binding mandate to take effect from January 1: report, 23 October 2026 — Inc42

1. CTCellularPlanStatus — Apple Developer Documentation

1. PDF copy of the PIB release on DoT's SIM binding directions — Department of Telecommunications

1. Apple has made the necessary changes to implement SIM binding on iOS: report, 23 October 2026 — MediaNama

1. IFF calls on DoT to recall the SIM binding direction, 12 December 2025 — Internet Freedom Foundation

1. Rajya Sabha Unstarred Question No. 2295, SIM binding directions, answered 12 March 2026 — Rajya Sabha, Department of Telecommunications

1. Telecommunications (Telecom Cyber Security) Amendment Rules, 2025 notified, 7 November 2025 — AZB & Partners

1. Fake calls and SMS scams: Digital Intelligence Platform and Financial Fraud Risk Indicator, 24 July 2025 — Press Information Bureau

1. DoT extends SIM-binding deadline for messaging apps to December 31 (PTI), 2 April 2026 — The Tribune

1. WhatsApp beta for Android 2.26.8.6: what's new?, 24 February 2026 — WABetaInfo

1. Security takes precedence: no relaxation to SIM-binding rules for messaging apps, says Scindia, 25 February 2026 — ETV Bharat

1. WhatsApp confirms SIM binding testing for regular Indian users, 7 April 2026 — MediaNama

1. Govt extends SIM binding deadline amid technical challenges, 2 April 2026 — MediaNama

1. DoT extends deadline for OTT app SIM-binding to December 31, 2026, 2 April 2026 — tele.net

1. Bureau launches Silent Mobile Verification for UPI device binding, 15 October 2026 — The Paypers

1. Registration flow, UPI Consumer Stack docs — Juspay

1. Use of SMS or Call Log permission groups — Google Play Console Help

1. MFMessageComposeViewController — Apple Developer Documentation

1. About verifying phone numbers — Android Developers

1. Indian mobile operators help online businesses combat scams and identity theft through new federated network services, 9 October 2025 — GSMA via PR Newswire

1. Automatic SMS verification with the SMS Retriever API — Google for Developers

1. SubscriptionManager API reference — Android Developers

1. Privacy changes in Android 10 — Android Developers

1. SubscriptionManager.OnSubscriptionsChangedListener API reference — Android Developers

1. CTCarrier — Apple Developer Documentation

1. com.apple.developer.upi-device-validation entitlement — Apple Developer Documentation

1. CTCellularPlanStatusAvailability — Apple Developer Documentation

1. CTCellularPlanStatusAuthorization — Apple Developer Documentation