Arattai Rolls Out SIM Binding Under India's Telecom Cyber Security Rules: Why the World Should Follow
Arattai, the Zoho messaging app, has begun binding accounts registered with Indian (+91) numbers to the active SIM on the user's primary device, under the Department of Telecommunications' SIM binding directions. Verification becomes mandatory for all signed-in +91 users on 30 November 2026. Tying a chat account to a live SIM closes a gap scammers exploit worldwide, and other countries and platforms should make it standard practice.
Indian messaging app Arattai has started tying user accounts to the physical SIM card behind them, becoming one of the first platforms to publicly roll out the Department of Telecommunications' (DoT) SIM binding requirement for app-based communication services.
The Gap It Closes
On most messaging apps, a phone number is verified once, usually by OTP, and the account then keeps working indefinitely, even after the SIM is removed, deactivated or reissued to someone else.
Scammers exploit this.
Accounts registered on numbers they no longer hold, or never legitimately held, keep running phishing, impersonation, digital arrest and investment fraud campaigns long after the SIM is gone.
SIM binding links the account on the primary device to the active SIM of the registered number.
If the SIM is removed or unavailable, the app asks the user to restore it before carrying on.
How It Works on Arattai
- New sign-ups and re-logins: after entering a +91 number, Arattai opens a pre-filled SMS. The user sends it unchanged, and Arattai checks it against the SIM.
- Existing sessions: these aren't affected until the user signs in again or until 30 November 2026. In-app verification opens by the end of October.
- Arattai Web and linked devices: these depend on the primary device. They work while it stays bound to its SIM, and must be restored from the primary device if the SIM is removed.
Timeline
- October 2026: SIM verification for new registrations and re-logins
- End of October: voluntary verification for existing users
- Early November: in-app reminders and banners
- Late November: daily reminders
- 30 November 2026: mandatory for all users signed in with a +91 number
The Legal Basis
DoT issued its SIM binding directions on 28 November 2025 under the Telecommunications (Telecom Cyber Security) Rules, 2024 (Notification No. CG-DL-E-21112024-258808), as amended (Notification No. CG-DL-E-22102025-267074).
The directions cover app-based communication services that use a mobile number for identification.
Clarifications issued on 26 February 2026 set how often binding is checked and when linked sessions are logged out.
The deadline for platforms to report compliance is 31 December 2026.
Why It Should Become a Global Practice
Messaging-led fraud is a cross-border industry.
Scam compounds in South-East Asia, call centres in South Asia and mule networks spread across continents all depend on the same weakness: a messaging identity that outlives the SIM it was created with.
A rule in one country only moves the problem to numbers from another.
A shared standard would shrink it.
- It ties accounts to real, accountable numbers. SIMs in most countries are issued after identity checks. Binding the account to a live SIM carries that accountability into the app, instead of letting it end at the first OTP.
- It kills recycled and burner accounts. Dropping a SIM disables the account on it, so fraudsters can't build up stocks of verified accounts and keep using them after the SIMs are thrown away.
- It blunts account takeover. An attacker who tricks a user into handing over an OTP still needs the physical SIM in the primary device to keep the account running.
- It cuts off remote operation. Scam compounds often run accounts on numbers whose SIMs sit in other countries or have been discarded. Requiring a live SIM in the primary device makes that much harder at scale.
- It helps investigators. When an account must stay attached to an active SIM, police and telecom regulators can trace it to a working number and a real subscriber.
- It's simple to deploy. A one-tap silent SMS check adds almost nothing for genuine users, and Arattai's phased rollout shows how to bring in existing users without disruption.
What Intermediaries Should Do
- Bind accounts to the active SIM on the primary device, and recheck regularly, not only at registration.
- Make linked web and desktop sessions depend on the bound primary device.
- Give users clear timelines, reminders and recovery paths, as Arattai has.
- Make exceptions for genuine needs such as roaming, dual-SIM phones and lost or stolen phones, with secure re-verification instead of blanket lockouts.
- Collect only what binding needs, and keep that data out of advertising and profiling.
Regulators should work toward a common standard through international telecom and cybercrime cooperation, so that a SIM-bound identity means the same thing across borders.
If every major platform did this, a scammer's messaging account would stop working when the SIM behind it is gone.