India’s WhatsApp SIM-Binding Deadline: 8 Checks Before January 1

What the January 1 SIM-binding deadline means now

India’s Department of Telecommunications (DoT) issued directions under the Telecom Cyber Security Rules on November 28, 2025, and PIB made the order public on December 1, 2025. The original directive named WhatsApp, Telegram, Snapchat, Arattai, ShareChat, Josh, JioChat and Signal, and it required these messaging services to keep accounts continuously linked to the registered active SIM. The original notice also described periodic web logout, originally not later than six hours. That wording matters, but it is not the whole current picture.

Current reporting on October 23, 2026 says the compliance deadline has been extended to December 31, 2026, with operational enforcement expected from January 1, 2027. The same reporting also says the blanket six-hour web logout has since been replaced by a risk-based approach. In other words, readers should not rely on the original six-hour language as the final implementation model.

This is not an outage story. It is a compliance story. The practical question for users is not whether every device will suddenly fail on January 1, but whether each account is properly tied to the active registered SIM and whether the app’s final product behavior matches the platform guidance when enforcement begins.

Confirmed, reported, and still unclear

The easiest way to read the situation is to separate what is documented from what is still being clarified in reporting and product behavior.

Confirmed: The original DoT direction was published by PIB on December 1, 2025 and named WhatsApp, Telegram, Snapchat, Arattai, ShareChat, Josh, JioChat and Signal.
Confirmed: The original release said roaming with the registered SIM present would not be affected.
Reported in current coverage: The deadline was extended to December 31, 2026 and enforcement is expected from January 1, 2027.
Reported in current coverage: The six-hour web logout rule was replaced with a risk-based approach.
Still unclear: Exact app-by-app implementation, edge-case behavior, and whether a particular linked device will stay active, sign out, or ask for re-verification.
Still unclear: Whether any special handling will apply to eSIM-only users, dual-SIM devices, number-porting cases, or device migrations in every platform’s final release.

How SIM binding differs from SMS OTP and app two-step verification

These three ideas are related, but they do not do the same job. SIM binding is about whether the messaging account must stay associated with the registered active SIM in the device. SMS OTP verification is usually a one-time code sent to a phone number to prove you control that number during sign-in or setup. App two-step verification is an extra security layer inside the app, often a PIN or passphrase, that helps protect the account from unauthorized access.

In plain language: an SMS OTP helps you prove you own the number at a moment in time. Two-step verification helps secure the account after setup. SIM binding is a continuing requirement that the service keep checking the account’s link to the active registered SIM. So turning on two-step verification is still a good security practice, but it does not replace the SIM-binding requirement.

8 checks to do before January 1

1. Identify the registered phone number or SIM for each messaging account. If you use more than one account, write down which number belongs to which app profile.
2. Check that the SIM tied to the account is active and present in the primary device, either physically or electronically, depending on how your phone stores the line.
3. Review dual-SIM and eSIM setups carefully, but do not assume outcomes that the platforms have not officially confirmed.
4. Audit every linked desktop, browser, and tablet session so you know where the account is signed in, while remembering that current reporting points to a risk-based logout approach rather than a universal six-hour timer.
5. Plan ahead for travel, roaming, SIM replacement, number porting, lost phones, and device migration, especially if the account is used for work or business continuity.
6. For shared or business accounts, document who owns the number, who controls recovery access, and who can approve changes; avoid informal SIM sharing.
7. Turn on app two-step verification and keep secure recovery details updated; this helps account security, but it does not replace SIM-binding compliance.
8. Watch for official in-app notices and ignore scams asking for OTPs, QR scans, or remote-access installation to ‘fix’ your account.

Do this now / Wait for official guidance / Do not do this

Do this now: Confirm which number is registered to each messaging account and review active linked devices.
Do this now: Keep the registered SIM active and accessible in the main phone you use for that account.
Do this now: Update recovery details and enable app two-step verification where available.
Wait for official guidance: Final behavior for eSIM-only setups, dual-SIM edge cases, and linked device logout timing.
Wait for official guidance: Any app-specific instructions on travel, roaming, number portability, or device migration.
Do not do this: Do not share OTPs, QR codes, or recovery codes with anyone claiming to ‘help’ with compliance.
Do not do this: Do not assume a rumor about one handset model or one brand applies to all devices.
Do not do this: Do not treat two-step verification as a substitute for keeping the registered SIM active.

Dual-SIM, eSIM, and number-porting practicalities

Dual-SIM users should first confirm which line the messaging app actually treats as the registered number. Do not guess based on the line used for voice calls or the SIM that is currently set for mobile data. If you recently swapped slots, replaced a SIM, or moved a number to eSIM, re-check the account’s registered line before enforcement starts.

A practical example helps: if your phone carries one personal line and one work line, the app may care about the specific account number, not the line you happen to use most often. If the wrong line becomes inactive, changed, or removed, the app may need re-verification or could behave differently depending on its final implementation. That is why documentation matters.

Number-porting can also create a temporary mismatch while the number moves from one carrier to another. During that window, avoid making assumptions about sign-in continuity. If your number is being ported, keep the account owner informed, preserve recovery access, and wait for the app’s own prompts before changing devices again.

For SIM replacement, the safest approach is to replace the SIM through the operator’s official process and then check the app’s account status immediately afterward. If the device is lost or stolen, prioritize securing the number with the operator, then update the messaging account once the replacement device is ready. None of this is a substitute for the platform’s final rules, but it reduces avoidable disruption.

Travel, roaming, device migration, and linked desktop/tablet access

International travelers should pay special attention to roaming and local-SIM changes. The original PIB release explicitly said roaming with the registered SIM present would not be affected. What has not been fully clarified in public reporting is how every app will treat temporary device changes, secondary data-only lines, or situations where the registered SIM is not physically in the phone but the number is still active through another arrangement. Users should wait for platform instructions rather than assume a best-case or worst-case outcome.

Device migration is another common pain point. If you are moving to a new phone, the key question is not just whether you can log in once, but whether the registered SIM remains active and whether linked sessions on a laptop or tablet still behave as expected. For some users, desktop access is essential for customer support, team coordination, or routine work, so it is sensible to review those sessions before making a hardware switch.

If you use desktop or tablet companions, treat them as dependent sessions rather than separate identities. Keep a record of which device is linked, who uses it, and how it will be reconnected if the primary phone changes. Because the latest reporting says the original blanket six-hour logout was replaced by a risk-based approach, you should expect more nuanced behavior than a single universal timer, but not assume every session will remain untouched.

For businesses and shared-use accounts

Small businesses, stores, clinics, delivery teams, and family-run operations should treat account ownership as a documentation task, not an afterthought. If a WhatsApp or Signal account is tied to a company contact line, record who owns the SIM, who handles verification, who can access linked devices, and how the account will be recovered if the phone is lost or replaced.

Avoid casual SIM sharing. If a number is shared across staff, that may create recovery and continuity problems later, especially when the registered line has to remain active for the account to function as intended under the new compliance model. A better practice is to assign a clear owner, keep recovery details current, and document the steps for handover if a staff member leaves or changes phones.

Comparison: why the reported change matters

The original directive described a broad six-hour logout model for web sessions.
Current reporting says that blanket model has been replaced by a risk-based approach.
That means implementation may depend on account risk signals, device behavior, or platform-specific checks rather than a single fixed timer.
Users should therefore prepare for possible sign-in prompts or session changes, but not assume a uniform logout wave across every app and every device.
This is also why unsupported-device panic is premature: the reporting does not justify claiming that every unsupported device will stop working on January 1.

FAQ: the biggest misconceptions

Q: Will every unsupported phone stop working on January 1? A: Not necessarily. Current reporting discusses operational enforcement from January 1, but exact app behavior still depends on each platform’s implementation.

Q: Are eSIM users automatically exempt or automatically blocked? A: Neither claim is confirmed in the source material provided. Users should verify how their app recognizes the active registered line.

Q: Will all linked web and desktop devices be logged out at the same time? A: The latest reporting says the original blanket six-hour rule has been replaced by a risk-based approach. That means users should expect platform-specific behavior, not a single universal logout event.

Q: If I’m roaming, do I need to panic? A: No. The original PIB release said roaming with the registered SIM present would be unaffected.

Q: Does two-step verification solve this requirement? A: No. Two-step verification improves account security, but it does not replace SIM-binding compliance.

Q: Should I trust anyone who asks for my OTP or a QR scan to ‘restore’ my account? A: No. Treat those requests as suspicious unless they come through verified official app flows you initiated yourself.

What to do next

The safest response is calm preparation, not panic. Verify the number attached to each account, confirm the active SIM, review linked devices, and keep recovery details current. Then wait for in-app instructions from the platform itself. If the service changes its login or device rules, those instructions will matter more than rumors, screenshots, or copied messages.

For readers who manage accounts for work, the key is continuity: know who controls the number, who can recover it, and how to move the account if the phone, SIM, or staff member changes. That is the practical takeaway from the new regime, whether you use WhatsApp, Signal, Telegram, or another named app.

PIB / DoT original directive

India Today current explainer and correction on six-hour logout

Gadgets 360 current implementation explainer

PIB / DoT and WhatsApp anti-fraud collaboration background