SIM-Binding Mandate could disrupt consumers, Raise Business Costs: Esya Centre Study

An Esya Centre report warns that DoT's SIM-binding mandate could inconvenience consumers, disrupt MSME operations and increase costs, while offering limited protection against cyber fraud.

New Delhi, October 30, 2026: A recent research report by the Esya Centre has warned that DoT's SIM binding requirement may adversely impact consumers' ability to use essential communication services, increase operational cost for MSMEs and have little benefits in cyber security.

"Rethinking India's SIM Binding Mandate: An Empirical Assessment," based on a survey of 2,033 consumers from 18 cities and 353 firms from 17 cities in India, has found that the requirements imposed by the directive may cause inconvenience and incur costs on legitimate users without resolving the major sources of modern-day cyber-fraud including phishing attacks, credential theft, malware attacks and session hijacking.

The Department of Telecommunications had, in November 2025, mandated internet-based messaging applications to ensure SIM card binding of users' account and automatic logout of web sessions after every six hours. However, the requirement was later revised into risk-based logout.

Consumers Risk Travel and Emergency Inconvenience

According to the study, SIM binding may lead to a considerable number of inconveniences to consumers, particularly in cases of international travels. Only 33% of international travelers have a roaming Indian SIM, while 67.1% rely on other types of SIMs (local, Wi-Fi, and secondary SIM).

The directive would limit the users from accessing certain communication services in case they are not able to keep their SIM registered. 98.88% of surveyed consumers believe that it will be inconvenient for them to lose access to messages in case of inactive SIM, especially while traveling. 98% of surveyed consumers are also concerned about losing access to Internet-based calls during emergency situations.

The research identifies such inconveniences as forced logouts and re-authentications from time to time. Although 97.7% of surveyed companion-device users find forced logouts inconvenient, 97% of surveyed consumers note that re-authenticating an Indian SIM periodically while traveling would be inconvenient because of the interruption of the conversation, multiple logins, and extra time to reconnect. Even though DoT has replaced mandatory logouts every six hours with risk-based ones, consumers may experience inconveniences due to re-authentication requirement.

SIM Binding Risks Business Disruption and Higher costs

The study highlights the growing dependence of Indian businesses on internet-based messaging services for customer interactions, employee coordination and service delivery. Among surveyed businesses, 92% rely on companion-device access, while 86% use the same business number across multiple devices.

Restrictions on such arrangements could significantly disrupt business operations. Approximately 78% of surveyed businesses anticipate that restricting access to a single handset would be extremely or moderately disruptive, while 83.5% expect delays and operational errors. Further, 82% report that forced logouts would disrupt ongoing information exchange and workflows.

These disruptions could also impose substantial financial burdens, particularly on MSMEs. More than three-fourths (76.3%) of surveyed businesses expect SIM-linked access restrictions to have an extremely or very significant financial impact. Specifically, 60.6% anticipate increased workplace-related expenses, 58.6% expect additional expenditure on devices and equipment, and 55% foresee increased staffing requirements.

SIM Binding May Do Little to Prevent Fraud

The study questions whether SIM binding can effectively address contemporary cyberfraud, which increasingly exploits vulnerabilities beyond SIM-based identity verification, including social engineering, compromised credentials and malware.

Survey findings reveal widespread scepticism regarding the directive's effectiveness. Although 87.2% of surveyed businesses express concern about SIM-related fraud, 81% do not believe SIM binding will meaningfully improve security. Similarly, 59% of surveyed consumers do not believe the directive would make messaging platforms safer.

The study also finds that consumers may respond to SIM-binding restrictions by adopting additional connectivity arrangements. Approximately 41% indicate that they would obtain an additional SIM card, while 30.3% would purchase a new device. Such responses could increase costs and complicate digital identity management without necessarily strengthening security.

Approach to Fraud Prevention

Rather than imposing broad restrictions on access to messaging services, the study recommends a more proportionate, risk-based approach to preventing cyberfraud.

The Esya Centre recommends that policymakers:

* Fraud-prevention measures should focus on the dominant mechanisms through which unauthorised access and financial deception occur rather than relying primarily on communication-access restrictions.

* Greater emphasis should be placed on strengthening upstream controls within the broader fraud ecosystem. Improving Know Your Customer (KYC) processes, reducing vulnerabilities in SIM issuance, strengthening fraud-detection systems, and addressing mule-account networks may offer more direct avenues for reducing fraud than interventions focused solely on messaging-platform access.

* Major regulatory interventions affecting digital communication systems must be accompanied by rigorous ex ante evaluation. The findings of this report highlight the importance of assessing not only intended security benefits but also impacts on communication resilience, user behaviour, business operations, and organisational efficiency. Evidence-based evaluation can help ensure that regulatory measures remain proportionate to the risks they seek to address and can be adapted as fraud techniques continue to evolve

These measures, it suggests, could address the underlying enablers of unauthorised access and financial fraud more effectively than restrictions focused solely on messaging platforms.

An evidence-based and proportionate regulatory framework, the study argues, would help strengthen fraud prevention while preserving the reliability and flexibility of India's digital communications ecosystem.

The study concludes that effective fraud prevention requires measures tailored to the mechanisms through which cybercrime occurs, rather than restrictions that affect legitimate users indiscriminately. A more targeted approach would allow India to strengthen digital security while preserving the accessibility, affordability and flexibility of communication services on which consumers and businesses increasingly depend.

Esya Centre is a New Delhi-based technology policy think tank that conducts empirical research on issues at the intersection of technology, markets, innovation and public policy.