Most businesses worry about SIM fraud, don’t think SIM binding will stop it: Survey

The SIM-binding directive, which will come into effect from January 1, requires messaging accounts to be linked to physical SIM cards for traceability

Nearly nine in 10 small businesses are worried about fraud linked to SIM cards, but most of them do not believe that tying messaging apps to SIM cards will make platforms safer, according to a survey of over 350 small firms by tech policy think tank Esya Centre.

The Esya Centre report argued that much of the online fraud happens through phishing, stolen passwords, malware and hijacked sessions, something SIM binding does not directly address. (Unsplash)

The survey covered 353 businesses across 17 cities, most of them small firms. About 87.2% said they were concerned about SIM-related fraud, while 81% said SIM binding did not offer security benefits. Separately, in a survey of 2,033 consumers across 18 cities, 59.2% said SIM binding would not make messaging platforms safer.

Both surveys were done between February and April 2026.

The survey report comes two months before the December 31 deadline for apps such as WhatsApp and Telegram to follow SIM binding rules notified by the Department of Telecommunications (DoT) ends. The initial deadline for SIM binding was February-end 2026. As first reported by HT on March 30, it was extended till December 31, 2026, following requests from companies.

The SIM-binding directive, which will come into effect from January 1, requires messaging accounts to be linked to physical SIM cards for traceability and mandates that web sessions be logged out at least once every six hours.

The Esya Centre report argued that much of the online fraud happens through phishing, stolen passwords, malware and hijacked sessions, something SIM binding does not directly address.

It also cited a study by the Indian School of Business, which found that telecom companies often don’t verify details given by SIM buyers against government databases such as Aadhaar, and that agents sometimes skip identity checks while issuing SIM cards. The report said fixing these gaps could do more to reduce fraud.

The survey report also voiced operational concerns. Of the businesses surveyed, 83.5% said delays and mistakes would become likely, and about 41% of consumers said they would consider buying an extra SIM card. These figures are what people expect to happen, not what has already happened.

SIM-binding directions

The guidelines on SIM binding were issued under the Telecom Cyber Security Rules in November 2025 and sent to companies providing app-based communication services in India, including WhatsApp, Telegram, Signal, Arattai, Snapchat, Sharechat, Jiochat and Josh.

DoT has said some of these apps let people use the service even when the SIM card linked to their mobile number was not in the phone, and that this was being misused to commit cyber frauds by entities located abroad. Under the directions, the apps have to make sure that the SIM card was in the device and connected with the mobile number used to identify the user. The app should not work without that specific and active SIM.

If the app has a web version, the user should be logged out regularly, no later than every six hours, and should be allowed to link the device again by scanning a QR code.

The directive faced pushback from the industry, with several messaging platforms raising concerns about how practical it was to implement it and what it would mean for user experience. Companies said that enforcing continuous SIM binding, especially across multiple devices and web logins, would need significant changes to how their apps are built, along with coordination with operating system providers.