India's SIM-Binding Mandate Offers Little Security, Study Finds

Disruption for consumers and MSMEs

The DoT announced the directive in November 2025 to link internet-based messaging apps to active SIMs. It also initially required web sessions to log out after every six hours of inactivity, a rule the government later changed to a risk-based approach.

Among consumers, 98.88% said losing messaging access because of an inactive SIM would be inconvenient, and 98% were concerned about losing internet access in emergencies. Some 97.7% of companion-device users said forced logouts would interfere with use. Among international travellers, 67.1% rely on alternative connectivity, while 33% use Indian SIMs with roaming.

Businesses appear even more exposed. In the survey, 92% use companion-device access and 86% share one business number across devices. Some 78% expect moderate or extreme disruption, 83.5% foresee operational delays and errors, and 82% said forced logouts would interrupt work. Further, 76.3% of MSMEs expect high additional costs, with 60.6% citing workplace costs, 58.6% devices and equipment, and 55% staffing.

Doubts over fraud prevention

Although 87.2% of businesses worry about SIM fraud, 81% doubt SIM binding is a worthwhile safeguard, and 59% of consumers question whether it would make messaging safer. The authors note that phishing, social engineering, stolen credentials and malware remain key tools for criminals. About 41% of consumers said they would get a second SIM and 30.3% would buy another device.

The think tank recommends a targeted, risk-based approach: stronger Know Your Customer checks, stricter controls on SIM issuance, better fraud detection and action against mule-account networks. It also urges detailed impact assessments before major rule changes, covering costs for consumers, business and communication reliability, and security benefits.