Cyber Security News

WhatsApp and Telegram May Stop Working Without Registered SIM Cards From January 1, 2027

WhatsApp and Telegram users in India may face access restrictions starting January 1, 2027, as messaging platforms implement the government’s SIM-binding requirements.

The Department of Telecommunications (DoT) has set December 31, 2026, as the compliance deadline, requiring messaging services to keep accounts linked to the active SIM associated with the registered mobile number.

These changes specifically target accounts that continue operating after their registered SIM is removed, replaced, or deactivated.

However, the extent of the restrictions will depend on how each platform implements these requirements, rather than causing an immediate universal shutdown when a SIM is no longer active.

New SIM Binding Rules

Messaging apps typically verify mobile number ownership during registration by sending a code via SMS. Once verified, an account remains accessible over Wi-Fi even if the associated SIM is no longer installed or active.

The new SIM binding rules change this model by requiring an ongoing connection between the messaging account and its registered SIM. Instead of treating initial verification as sufficient, platforms must ensure the registered mobile identity remains linked to an active SIM on the device.

CNBC TV18 reports suggest that these requirements will also apply to eSIM profiles. Therefore, the distinction is not just between physical SIM cards and digital alternatives, but also hinges on whether the registered number remains active and available for verification.

The DoT recently said that persistent messaging sessions let criminals misuse Indian mobile numbers after SIM cards are removed, deactivated, or taken abroad.

Such accounts can enable cross-border fraud, impersonation of government officials, and scams that pressure victims to transfer money.

The Telecom Cyber Security Rules, 2024, issued the directives to strengthen the link between telecom identifiers and communication services and reduce opportunities for criminals to operate accounts disconnected from their registered SIMs.

The original directive named several messaging platforms, including WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh, and JioChat.

However, reports vary on the current status of individual services, particularly Snapchat and Signal, so platform-specific announcements are essential.

Users accessing their accounts on secondary phones, tablets, or devices without the registered SIM could experience restrictions. Travelers who replace their usual SIM with a local card may also need to review their account settings.

Web sessions are another affected area. Although the original guidelines specified logout intervals of no more than six hours, later updates describe a revised, risk-based approach rather than mandatory six-hour disconnections for everyone.

Users are advised to keep their registered numbers active and monitor official platform instructions. The December deadline sets the compliance timeline, but specifics on verification frequency, linked-device behavior, and account restoration procedures will depend on each platform’s implementation. These rules focus on account authentication and do not imply a blanket ban on specific smartphone models.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown

StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted…

10 hours ago

Critical Okta Access Gateway Vulnerability Enables Remote Command Execution

A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could…

10 hours ago

Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems

Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of…

11 hours ago

Capcom Confirms Data Breach Exposing 11.7 Million CAPCOM ID Records

Capcom has confirmed a data breach that affects 11,774,247 CAPCOM ID records worldwide. An unauthorized…

11 hours ago

Quest Diagnostics Confirms Cyberattack Exposing Patient Records in Quanum System

Quest Diagnostics disclosed unauthorized access to its Quanum LSM system, confirming that an unidentified party…

11 hours ago

Unauthorized AI Agents Found Accessing Customer Accounts at Major U.S. Banks

U.S. banks face challenges as third-party artificial intelligence agents detect unauthorized access to customer accounts.…

11 hours ago