Why SIM-binding mandate is concern for consumers, MSMEs, and cybersecurity, a new study decodes

The Indian government’s plan to introduce a new provision requiring both physical and digital SIM cards to be linked to messaging apps has sparked opposition from businesses and consumers, as it will not make any significant difference to cybersecurity, a new study by the think tank Esya Centre has concluded.

The report, titled “Rethinking India’s SIM Binding Mandate: An Empirical Assessment“, investigates the possible implications of the Department of Telecommunications (DoT) order on users, businesses, and digital security.

The study, which polled 2,033 consumers in 18 cities and 353 businesses in 17 cities, identified several problems, including communication disruption, increased operational costs, and the effectiveness of SIM binding in combating cyber fraud. It says that limitations on access to messaging could affect legitimate users while leaving more significant cybercrime techniques, such as phishing, credential theft, malware, and session hijacking, essentially unchecked.

SIM-binding mandates could disrupt consumers, especially during travel

In November 2025, the DoT announced the SIM-binding directive to tie internet-based messaging apps to active SIMs. It also originally required a logout of Web sessions after every 6 hours of inactivity. However, the government later revised the logout requirement to a risk-based approach.

The study by the Esya Centre says that the need might pose problems to international travellers who rely on local phone numbers, Wi-Fi, or alternative data connections. Of the surveyed international travellers, 67.1% used alternative modes of connectivity, compared with 33% who used Indian SIMs with international roaming services.

98.88% of the consumers surveyed found losing messaging access because of an inactive SIM card to be an inconvenience, the report revealed. Meanwhile, 98% said they were concerned about not being able to use the Internet during emergencies. Some 97.7% of companion-device users also indicated that forced logouts would interfere with their use of the device.

MSMEs could face higher costs and operational disruptions

The directive may also affect companies that rely on messaging systems for business communications, employee coordination, and operations.

The Esya Centre discovered 92% of the businesses surveyed had companion-device access, and 86% had the same business number across their devices. 78% thought that restricting access to the phone would be moderately or extremely disruptive, and 83.5% said they would expect operational delays and errors.

82% of the businesses surveyed said they would be interrupted by forced logouts. The financial impact can be particularly severe for MSMEs, with 76.3% anticipating high additional costs.

The report also revealed that 60.6% of businesses were looking for more costs to be associated with the workplace, 58.6% of businesses were looking for more spending on devices and equipment and 55% of businesses were looking for more staffing.

Study questions on SIM binding’s effectiveness against cyber fraud

The report also raises doubts about how well SIM binding can prevent modern-day cyber fraud, as well as about consumer and business issues.

87.2% of businesses surveyed were worried about SIM fraud, yet 81% were not convinced that SIM binding would be a worthwhile security measure. Similarly, 59% of consumers doubted that the requirement would make messaging platforms safer.

In the study, the researchers conclude that phishing, social engineering, stolen credentials and malware are all being used alongside SIM-related vulnerabilities as additional tools for cybercriminals.

It also cautions that the restrictions may drive users to other solutions. Approximately 41% of consumers surveyed indicated they would get a second SIM card, and 30.3% said they would buy another device.

What does the Esya Centre recommend?

Instead of relying primarily on messaging access restrictions, the report recommends a targeted, risk-based approach to fraud prevention. It recommends enhanced Know Your Customer (KYC) procedures, stricter measures to prevent the issuance of SIM cards, improved fraud-detection measures, and action against mule-account networks.

The think tank also suggests that detailed analysis be carried out prior to implementing substantial changes to the regulations. These assessments should encompass price advantages for consumers, business and communication reliability, as well as cybersecurity advantages.

The report concludes that India’s fraud-prevention strategy should focus on addressing the underlying methods used by cybercriminals while ensuring that legitimate consumers and businesses can continue accessing digital communication services without unnecessary disruptions.