For most Indians, WhatsApp, Telegram and similar apps are part of daily life. They carry family chats, school updates, customer orders and invoices. A proposed change to how these apps authenticate users could make that routine much harder, according to a new study by CUTS International.
What the rule says
The Department of Telecommunications (DoT) issued SIM-binding directions under the Telecommunications (Telecom Cyber Security) Amendment Rules, 2025. They require OTT messaging apps to stay continuously linked to a user’s SIM card, and originally required web and desktop users to be logged out every six hours.
The government’s concern is real. DoT says accounts on messaging and calling apps keep working even after the SIM is removed, deactivated or taken abroad, which lets scammers operate anonymously, including in “digital arrest” frauds and government impersonation calls. Fighting that kind of fraud is a legitimate goal. The question is whether this mechanism is the right way to do it.
What the CUTS survey found
CUTS surveyed 4,200 respondents, 3,600 consumers and 600 small and medium businesses (SMBs). The headline results:
- Nearly 80% of consumers and over 60% of SMBs may face disruptions, ranging from OTP requirements to repeated re-logins.
- About 86% of users say they let family members use their phone or SIM for messaging. Shared devices are common in Indian households, and a rule that assumes one person, one SIM, one phone doesn’t match how many people live.
- CUTS also warned that lower-income households, where shared access is common, could be disproportionately affected and may struggle to reach essential digital services in time.
Why small businesses are hit hardest
For a large company, a new login step is a minor annoyance. For a micro-enterprise it can be a daily problem. Cloud kitchens, resellers and other small ventures often run entirely on WhatsApp for communication, marketing and sales. These businesses typically have several staff members using the same business number on web or desktop, and frequent forced logouts and OTP checks add friction at the busiest moments.
CUTS researchers describe how repeated disruptions can erode productivity, trust and revenue, turning a small technical rule into a systemic problem. Creators, advertisers and small agencies that depend on smooth multi-device access face the same slowdown.
Some industry voices see a mixed picture. One expert noted that small businesses could gain protection against fraud and impersonation, but would also face more operational complexity and onboarding hurdles, especially if they have limited IT resources.
A better path: consult first, then regulate
CUTS isn’t arguing against fighting fraud. Its argument is about process and design. It calls for structured dialogue with consumers, small businesses, technical experts and civil society before technology-prescriptive mandates are introduced. Its Secretary General has urged policymakers to pause, consult, carry out regulatory impact assessments and adopt a risk-based, evidence-driven approach before scaling such interventions.
On alternatives, CUTS has recommended silent, real-time background API verification and tighter KYC at the point of SIM issuance as more effective options. The logic is that if the weak point is how SIMs are issued, stronger checks at issuance may stop more fraud than tying every messaging session to a SIM.
Where things stand
The government has already softened its position. The compliance deadline for messaging apps has moved to 31 December 2026, and the mandatory six-hour logout has been dropped. Web logout is now to follow a risk-analysis-based approach. These changes show that the policy’s technical complexity is being recognised.
The takeaway
Good regulation protects users without breaking the tools they rely on. SIM binding may help against some kinds of fraud, but India’s messaging ecosystem is diverse: shared phones, multiple devices, small teams and non-SIM environments are all common. With the deadline still ahead, there is time to test the rules against real-world use, hear from the people they affect and choose the least disruptive way to reach the security goal.