WhatsApp's New Security Rules in India#
January 26, 2026
India is introducing strict rules for messaging apps: WhatsApp, Telegram, and other apps are required to constantly check the user's SIM card activity. The new requirements from the Department of Telecommunications (DoT) are aimed at combating fraud, but they fundamentally change the traditional user experience.
Contents#
What are the new rules#
The rules introduce two key technical requirements that messaging apps must implement within 90 days:
- SIM card binding:
- Previously, the number was verified with a one-time code (OTP) only during registration. After that, the app could work even if the SIM card was removed or inactive.
-
Now, apps must constantly check that the registered SIM card is active and present in the device. If the SIM card is removed, replaced, or deactivated, access to the account will be blocked.
-
Web sessions:
- Previously, web versions (e.g., WhatsApp Web) remained active until the user manually logged out.
- Now, all web and desktop sessions will automatically end every 6 hours. To continue using the app, you will need to scan the QR code again.
The new requirements technically represent a shift from one-time number verification to ongoing verification of the unique SIM card identifier (IMSI). This should make it more difficult for fraudsters to use stolen or illegitimate numbers.
Why is this necessary#
Indian authorities claim the new regulations are aimed at combating digital fraud.
According to the government, the current system, in which phone numbers are linked only once during setup, creates a loophole for criminals. Fraudsters actively use stolen or purchased accounts to send spam and defraud users, including those from abroad. Constant verification is intended to make this process more difficult.
How will this affect users and businesses#
For users#
-
Loss of flexibility. Users who will be most affected are those who: frequently change SIM cards or devices; actively use tablets or second phones with only Wi-Fi, without an active SIM card; travel, temporarily using local SIM cards.
-
Missing important messages. Automatically logging out of WhatsApp Web every 6 hours can result in missed notifications if the user doesn't notice the disconnect and doesn't re-login in time.
-
Inconvenience for multi-device use. The latest versions of WhatsApp allow you to use one account on multiple devices (up to 4 additional ones), and these can work even if the primary phone is turned off. The new rules could disrupt this well-established architecture, once again making the constant presence of an active primary phone mandatory.
For Business#
-
Support Interruptions. Teams using WhatsApp Web or Desktop to communicate with customers will be forced to pause work every six hours to re-authorize. This may lead to delays in responses and disruption to workflows.
-
Issues for Meta Verified business accounts. Business solutions that allow more than four devices to be connected to a single account will encounter technical difficulties. Multiple employees working simultaneously may be disconnected due to new session limits.
-
Device Management Difficulties. Businesses whose employees use work phones or frequently move between office computers and personal devices will need to review their internal information security and messaging app usage policies.
Conclusion#
The new rules in India are a large-scale experiment in tightening controls in the digital sphere under the guise of combating fraud. If deemed successful, other countries may adopt similar practices. For users, this means a return to a less flexible model where the messaging app is rigidly tied to a single physical device—the SIM card. For businesses, this means new operating costs and the need to adapt workflows.
At GREEN-API, we monitor all WhatsApp updates to provide you with the latest news and solutions for automating your business processes. Stay tuned to stay up-to-date with all the latest developments!