India mandates SIM-linked messaging apps to fight rising fraud

India’s Department of Telecommunications has ordered messaging apps to operate only with active SIM cards linked to users’ numbers to curb fraud and misuse, after noting that some app-based services permit access without the underlying SIM. Indian Government now requires apps such as WhatsApp, Telegram, Signal, Snapchat and others that use Indian mobile numbers as identifiers to comply with new SIM-binding rules within 90 days, as part of an amendment to the 2024 Telecom Cyber Security Rules.

Web sessions must auto-logout within six hours, with apps given 120 days to report on implementation. The measure aims to close a security gap exploited for large-scale cross-border fraud, where accounts stay active after a SIM is removed or taken abroad. The policy notes long‑lived sessions enable fraudsters to control victims’ accounts from distant locations, and auto‑logout every six hours is intended to reduce account takeovers and mule‑account operations.

With cyber-fraud losses topping ₹22,800 crore in 2024, the new Telecom Cyber Security measures seek to improve traceability and curb identifier misuse, extending device-binding practices used in banking to messaging apps. according to the Department of Telecommunications