WhatsApp users in India may face access issues without a registered SIM under new government rules expected to take effect on January 1, 2027.

Messaging platforms reportedly have until December 31, 2026, to comply. The change could affect people using accounts on secondary phones, tablets, and devices without an active registered SIM.

The requirement, known as SIM-binding, means an account must remain connected to the active SIM associated with its registered mobile number. Unlike a one-time text verification code, this creates an ongoing link between the messaging service and the SIM installed in the device.

WhatsApp Stops Working Without SIM

The Department of Telecommunications issued its original directions on November 28, 2025, under the Telecom Cyber Security Rules, 2024, as amended. Its official explanation names WhatsApp, Telegram, Signal, Snapchat, Arattai, ShareChat, Josh and JioChat among the covered services.

Messaging accounts can still work after the associated SIM is removed or deactivated. DoT says criminals exploit this gap to operate accounts remotely, including from outside India, while using Indian numbers for phishing, investment fraud and fake government calls. The government cited cyber-fraud losses exceeding ₹22,800 crore in 2024.

The directions aim to make those accounts easier to trace by requiring continued access to the registered SIM. However, the policy should not be mistaken for a guarantee that it will prevent every scam or account takeover.

The original order required web sessions to log out at least every six hours. However, recent reporting says this blanket requirement has been replaced with risk-based logouts.

According to CNBC-TV18, WhatsApp sessions may end when suspicious activity is detected, potentially disrupting users who remove, deactivate, or switch their registered SIM cards while traveling.

Rules for tablets, companion phones and other linked devices will depend on each platform’s implementation. DoT’s original explanation says roaming is unaffected when the registered SIM remains in the handset.

SIM binding addresses number misuse, but device-linking scams remain a separate concern. Cybersecurity News previously reported on WhatsApp GhostPairing attacks, where victims approve an attacker’s linked device.

Russian-linked phishing campaigns that abuse legitimate WhatsApp linking requests. These attacks show why controlling a phone number alone doesn’t eliminate every account-security risk.

Users should review WhatsApp’s Linked Devices section and remove unfamiliar sessions. January 1 should be treated as the expected rollout date, not proof that every unsupported setup will stop working simultaneously. Actual disruption will depend on platform readiness and the final changes each service introduces.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.