In a new report, Esya Centre finds that nearly all consumers, out of the 2,033 consumers and 353 small businesses they surveyed, would find SIM binding inconvenient and 82% of those businesses expect forced logouts to disrupt operations. What has been left out by the survey, and also by the Department of Telecommunications (DoT) itself, is the measurement of how much fraud is conducted through accounts which work even after their SIM is removed. DoT claimed in its November 2025 directive that it is solving this problem.
Who was surveyed?
- Consumers: 2,033 people in 18 cities, 76% urban and 24% semi-urban, but no rural respondents were included.
- Businesses: 353 firms in 17 cities, out of which 79% have 10 or fewer employees, 52% are in retail and 6% in manufacturing.
- Not published: The questionnaire, the sampling method, the response rate and any weighting were not shared and the report calls the consumer sample “a representative view of the population segments most likely to rely on messaging platforms for communication.”
- Sub-samples: The endnotes mention that the 97.7% who would find “forced logout from companion devices” inconvenient are multi-device users. The 84.3% who cite “frequent re-login” as a burden are respondents who “use online messaging applications across multiple devices and express dissatisfaction with the mandatory 6-hourly logout requirement”.
Findings of the Survey
- Of the 353 businesses, “around 86%” have one business number on more than one device, and “around 92%” reach messaging through laptops, desktops or tablets. 75.6% these have at least two or three people handling customer messages.
- Among the 73 respondents who go abroad at least once a year, “only 33% rely on an Indian SIM with an active roaming plan”. The rest use a local SIM, Wi-Fi or a second number.
- If a mandate came in, 41% of consumers said that they would buy another sim, and the report says the policy “could drive users to acquire additional SIMs and manage more phone numbers simply to maintain access to essential communication services.”
- The report says that “60.6% of firms anticipate higher occupancy costs, 58.6 percent additional device purchases, and 55 percent increased headcount”. However, none of these businesses were asked for specific figures.
- It was said that SIM binding would not make messaging safer by 59.2% of consumers and 81% of businesses.
- The report cites an Indian School of Business study to say that operators often do not check onboarding documents against government databases and that “as many as 89% of alternate subscriber numbers are not Aadhaar-linked”.
Consideration for New Rule: The report only partly considers the new rule as the fieldwork ended before the DoT removed the six-hour logout. This change was made in April 2026 when the Minister of State for Communications told the Rajya Sabha that web sessions “are required to be logged out on the basis of risk-based analysis”. Then the compliance deadline was moved to December 31, 2026. MediaNama noted at the time that the written directive does not mention risk-based logout, and there has not been a revised written direction since then.
On SIM binding and fraud: The report argues that “many prevalent attack vectors operate through software-level compromise, credential theft, malware infections, phishing, and session hijacking rather than weaknesses in subscriber identification”. Its survey evidence on this point is based only on the opinion of its respondents.
The report summarises the DoT’s direction as saying that “accounts on instant messaging or calling apps work even after the underlying SIM is removed or deactivated” and that “long-lived desktop/web sessions allow fraudsters to control individuals’ accounts remotely without the original device or SIM”. The report does not consider fraud of either kind, and the DoT has not yet published a count either.
The one figure the chapter offers is that “approximately 87% of successful breaches were attributed to the theft or misuse of session tokens” in 2024 and this comes from a security vendor’s blog and does not clarify details about the breaches.
What engineers said on SIM binding disrupting messaging in December 2025: Esya’s survey says that re-authentication is being considered a burden by users. During MediaNama’s discussion on SIM binding in December 2025, speakers explained where this burden stems from.
“The iOS system prevented it long back. Why are they preventing it? Because it is a privacy issue,” said Parag Kar, former Vice President for Government Affairs (India and South Asia) at Qualcomm. “Without that OTP, you cannot verify whether the SIM is present on the phone or not.”
While the December 2025 discussion also did not focus on any specific rupee figures, it did name the source:
“If the DoT’s order has to be implemented on a continuous basis, the user’s mobile bill is going to increase from the current level to a potentially disproportionate level. At the same time, the bills for WhatsApp or any other entity that has to keep sending SMS will also rise,” Kar said.
On the security benefit, Anand Venkatanarayanan, Co-Founder of Deepstrat, said in December:
“I would say it would probably make no difference for fraudsters, because they would then go back to using different types of messengers.”
Venkata Satish Guttula, Cyber Security Consultant at Allied Boston Consultants, pointed to international and virtual numbers and eSIMs: “This [SIM mandate] is not a silver bullet.”
Esya’s report recommends:
“a risk-based approach that focuses identity-linked controls on fraud pathways where identity misuse is demonstrably central”.
Venkatanarayanan said in December:
“It is perfectly possible to create a composite risk index without getting involved in SIM binding for cybercrime.”
The cybercrime numbers present in the report: The report’s first footnote says, “28.15 lakh cybercrime cases were reported in 2025, up 24% from 22.68 lakh in 2024, with financial losses reaching Rs 22,495 crore (MHA, 2025)”. Its reference list gives “MHA, 2025” as the Ministry of Home Affairs’ Annual Report 2024-25, which cannot carry full-year 2025 figures. It is also important to consider the difference between “cases” and “complaints”. This same 28.15 lakh number was cited by ThePrint as complaints, not cases.
Recommendations of the Report include:
- Target the fraud: “Fraud-prevention measures should focus on the dominant mechanisms through which unauthorised access and financial deception occur.”
- Keep multi-device access: “Regulatory approaches should preserve communication continuity and multi-device functionality.”
- Fix KYC first: “Improving Know Your Customer (KYC) processes, reducing vulnerabilities in SIM issuance, strengthening fraud-detection systems, and addressing mule-account networks may offer more direct avenues for reducing fraud.”
- Evaluate before mandating: “Major regulatory interventions affecting digital communication systems should be accompanied by rigorous ex ante evaluation.”
MediaNama has filed RTIs with the DoT on SIM binding and will publish the replies as they come. MediaNama has also written to the Esya Centre and the DoT, asking:
Esya:
- Who recruited the respondents, was the data weighted, and will it share the questionnaire, fieldwork dates and response rate?
- Did the survey ask businesses for monetary estimates of the extra rent, devices and staff they anticipate?
- Can the forced-logout results be separated from SIM binding as such?
- What document is “MHA, 2025”, and does it describe the 28.15 lakh figure as cases or complaints? What population does the 87% session-token figure cover?
- Who funded or commissioned the survey?
DoT:
- What data on accounts operating after SIM removal, or sessions operated from abroad, was relied on before the direction was issued, and will the department publish it?
- Has a revised written direction replacing the six-hour logout been issued, and how will the department measure whether SIM binding has reduced fraud?
This story will be updated with responses as they come in.
Also read:
- Govt extends SIM binding deadline amid technical challenges
- WhatsApp confirms SIM binding testing for regular Indian users
The post Survey finds SIM binding may disrupt business, but will it stop fraud? appeared first on MEDIANAMA.