Telecom Cyber Security Rules, 2024

The Telecommunications (Telecom Cyber Security) Rules, 2024 are a set of rules that tell telecom companies, and now also apps that use your mobile number, how to keep India's telecom networks safe from cyber attacks and fraud. They were made by the central government under the Telecommunications Act, 2023. In simple words, these rules are the "safety code" for anything in India that runs on mobile numbers, SIM cards and phone networks. SIM binding for messaging apps comes from these rules.

Why are these rules needed?

Almost every Indian now uses a mobile number as their identity. Your bank sends an OTP to it, your UPI app is linked to it, and your WhatsApp account is your number. So if a criminal controls a number, they can pretend to be someone else, cheat people and hide their own identity. Cyber criminals also tamper with phones, use SIM boxes (machines that hold many SIMs) and run accounts from abroad. The rules try to close these gaps by making both telecom companies and apps responsible for security.

Where did they come from?

Earlier, telecom security rules were made under the Indian Telegraph Act, 1885. One such set was the Prevention of Tampering of the Mobile Device Equipment Identification Number Rules, 2017. In December 2023, Parliament passed the Telecommunications Act, 2023, which replaced the old Telegraph Act. Section 22 of the new Act lets the central government make rules on telecom cyber security.

The DoT released draft rules in August 2024. The final rules were notified on November 21, 2024 (G.S.R. 720(E)) and came into force on that day. They replaced the 2017 tampering rules.

What do the 2024 rules require of telecom companies?

• A cyber security policy: every telecom entity must have a written policy on security safeguards, risk management, training, network testing and how to respond to an attack.
• A Chief Telecommunication Security Officer (CTSO): a senior person who makes sure the rules are followed and coordinates with the government.
• Fast incident reporting: a security incident must be reported to the central government within 6 hours, and a detailed report (number of users affected, area affected, steps taken) within 24 hours.
• Sharing data for security: the government or its authorised agencies can ask for traffic data (data about calls and messages, not their content) for cyber security purposes. The entity must keep this data confidential.
• IMEI registration: makers and importers of phones and modems must register each device's IMEI number with the government before it is first sold in India. Tampering with an IMEI is banned.
• Action against misuse: the government can suspend a telecom identifier (such as a mobile number) that is used for fraud, cheating or impersonation.

What did the 2025 amendment add?

The DoT notified the Telecommunications (Telecom Cyber Security) Amendment Rules, 2025 on October 22, 2025. They made two big changes.

• They created a new category called Telecommunication Identifier User Entity (TIUE). This means any business, other than a telecom company, that uses mobile numbers to identify, verify or serve its customers. Messaging apps, banks, e-commerce platforms and fintech apps can all fall in this group.
• They set up a Mobile Number Validation (MNV) platform (Rule 7A). A TIUE can use it to check whether a mobile number really belongs to the person giving it. The draft of June 2025 had fixed fees per check; the final rule leaves the fee to be announced on the DoT portal.

How does SIM binding work?

Today, you register WhatsApp once with an OTP sent to your SIM. After that, you can take the SIM out, put it in another phone, or even throw it away, and the WhatsApp account keeps working on Wi-Fi. Criminals exploit this. They buy or steal an Indian SIM, register an account, send the SIM away and then run scams from another country with an Indian number. Under SIM binding:

1. The app must keep checking that the SIM used to register the account is present and active in the phone.
2. If the SIM is removed, changed or deactivated, the app stops working until the user verifies again.
3. Linked web or desktop versions (like WhatsApp Web) must log out regularly. The original November 2025 direction said at least every 6 hours, with re-login by QR code. Reports in 2026 say this was later softened to a risk-based approach, where sessions are ended at once only when fraud is suspected.

Think of it like a bank locker that opens only when the key holder is physically standing in front of it. Earlier, the "key" (the OTP) was used once and the locker stayed open forever.

The law that backs it

Section 42 of the Telecommunications Act, 2023 makes tampering with telecom identifiers, and knowingly using equipment with tampered identifiers (such as a SIM box), an offence. The punishment can be jail up to 3 years, a fine up to ₹50 lakh, or both. These offences are cognizable and non-bailable.

India's position and Indian examples

The rules sit inside a wider anti-fraud system. The DoT runs the Sanchar Saathi portal where citizens can block lost phones and check how many SIMs are issued in their name. The Ministry of Home Affairs runs the Indian Cyber Crime Coordination Centre (I4C) and the 1930 cyber fraud helpline. Banking apps in India already use device binding, which is why UPI apps ask you to verify the SIM in the phone. SIM binding extends the same idea to messaging apps.

Commonly confused concepts

• SIM binding vs device binding: SIM binding ties an account to a specific SIM card. Device binding ties it to a specific phone handset. UPI apps use both.
• SIM binding vs KYC (Know Your Customer): KYC checks who you are when you buy a SIM. SIM binding checks that the same SIM is still in the phone every time you use the app.
• Telecom Cyber Security Rules vs IT Act, 2000: the Telecom rules are made under the Telecommunications Act, 2023 and are enforced by the DoT. The IT Act and its rules (for example, the IT Rules, 2021 for social media) are enforced by the Ministry of Electronics and Information Technology (MeitY). Messaging apps were earlier treated only as "intermediaries" under the IT Act; the TIUE category brings them partly under telecom rules too.
• Traffic data vs content: traffic data is information about a call or message (who, when, where). Content is what was actually said. The 2024 rules allow sharing of traffic data, not content.

Issues, criticism and the way forward

• Jurisdiction: industry bodies such as the Internet and Mobile Association of India (IAMAI) and the Broadband India Forum have questioned whether telecom rules can cover internet apps, which they say fall under the IT Act.
• Inconvenience to genuine users: people who travel abroad and use a local SIM, use Wi-Fi-only tablets, or use one account on many devices may face problems.
• Privacy: constant SIM checks and data sharing raise concerns under the right to privacy (K.S. Puttaswamy v. Union of India, 2017) and the Digital Personal Data Protection Act, 2023.
• Effectiveness: critics say criminals can still use mule SIMs (SIMs bought in other people's names) inside India. Supporters say SIM binding removes the easiest route for scams run from abroad.
• Way forward: experts suggest clear legal backing in the parent law, a risk-based approach instead of blanket logouts, and joint guidance by the DoT and MeitY so that apps do not face two separate rulebooks.

Concepts to Know

• SIM card: a small chip from a telecom company that connects your phone to its network and carries your mobile number. An eSIM does the same job but is built into the phone.
• OTP (One-Time Password): a short code sent by SMS that works only once, used to prove you have the phone number.
• IMEI (International Mobile Equipment Identity): a unique 15-digit number for every mobile handset, like a vehicle's chassis number.
• SIM box: a machine holding many SIM cards that criminals use to route international calls so they look like local Indian calls.
• Phishing: tricking people into giving passwords or bank details through fake messages, emails or websites.
• Cognizable and non-bailable offence: police can arrest without a warrant, and bail is not a right; a court decides whether to grant it.