The government has brought all digital services that use mobile numbers — from WhatsApp and payment apps to food delivery platforms — under telecom cybersecurity regulations, empowering authorities to order immediate suspension of user accounts across multiple services simultaneously.
The Telecommunications (Telecom Cyber Security) Amendment Rules, 2025, notified on October 22 and effective immediately, also establish a government-run mobile number verification (MNV) system and mandate database checks before buying or selling used phones.
The measures are meant to target a cybercrime surge based on stolen or forged mobile connections and phone handsets that saw financial fraud losses jump from ₹7,465 crore in 2023 to ₹22,845 crore in 2024, according to data from the Indian Cyber Crime Coordination Centre (I4C).
The rules create a new category called Telecommunication Identifier User Entities (TIUEs), covering any business that uses phone numbers to identify customers or deliver services — except licensed telecom operators.
This brings platforms such as Zomato, Swiggy, PhonePe, Paytm, Ola, Uber and messaging services under the same regulatory framework that governs Airtel and Jio.
TIUEs must now comply with government directives on suspending phone numbers, respond to data requests about numbers they use, and verify customer identities as prescribed by authorities, according to the new rules.
{{/usCountry}}TIUEs must now comply with government directives on suspending phone numbers, respond to data requests about numbers they use, and verify customer identities as prescribed by authorities, according to the new rules.
{{/usCountry}}When the government flags a phone number for security reasons, it can order both telecom operators and apps to suspend its use — potentially locking users out of multiple services at once.
The rules allow authorities to act immediately without prior notice if deemed necessary for “public interest”, requiring only that reasons be recorded.
Government verification gateway
The centrepiece of the amendments is a Mobile Number Validation (MNV) platform that will verify whether phone numbers provided by users correspond to legitimate telecom subscribers.
Apps and services can request validation through this government platform, either voluntarily or when directed by authorities. Government agencies will have assured access.
The system will check user-provided numbers against databases maintained by telecom operators like Airtel, Jio and Vi.
Fees for the service will be shared between the government or its designated agency and the telecom operators providing validation data, though specific amounts have not been announced.
The rules require all parties to ensure compliance with data protection laws when conducting validations, but implementation details remain unclear.
Used phone sales require checks
Anyone buying or selling a used mobile phone must now verify its International Mobile Equipment Identity (IMEI) number against a government database before completing the transaction.
The database, to be maintained by the government or an authorised agency, will list IMEI numbers of devices that have been tampered with, reported stolen, or restricted for fraud or security reasons.
Selling or purchasing devices with blacklisted IMEIs will be prohibited. Buyers must pay a fee, yet to be specified, to access the database.
Additionally, manufacturers cannot assign IMEI numbers already in use in Indian networks to new devices manufactured in or imported to India, though the start date for this requirement has not been announced.
The regulatory push responds to specific fraud patterns proliferating across India’s digital economy.
Over 740,000 cyber crime cases were reported in just the first four months of 2024, with 85% related to online financial fraud, according to most recent I4C data.
Investment and trading scams — often conducted through WhatsApp groups or Telegram channels using fake identities — accounted for over 83,000 cases during that period.
Criminals routinely use fake, stolen or cloned mobile numbers to bypass one-time password verification, create fraudulent accounts on platforms, and impersonate legitimate users.
The stolen phone market has emerged as a major enabler, with devices bearing cloned or tampered IMEIs used to conduct fraud whilst evading tracking. The mandatory IMEI checks aim to disrupt this supply chain.