Centre tells Supreme Court SIM-binding for WhatsApp can help curb digital arrest scams

The Dawn of Digital Vigilance: Centre’s Proposal to the Supreme Court on SIM-Binding

The landscape of cybercrime in India has undergone a radical and terrifying transformation in recent years. Among the most sophisticated and psychologically damaging of these crimes is the “digital arrest” scam. As these cases proliferate, the Union Government has taken a significant stand before the Supreme Court of India. In a recent submission, the Centre proposed that mandatory SIM-binding for WhatsApp accounts could serve as a formidable deterrent against these scams. This move marks a pivotal moment in the intersection of digital privacy, intermediary liability, and national security.

As a senior legal practitioner, one must view this development not merely as a technical update but as a profound shift in how the state intends to regulate Over-the-Top (OTT) communication platforms. The proposal aims to bridge the gap between anonymous digital presence and verified physical identity, a gap that scammers have exploited with impunity. By requiring WhatsApp to be linked to an active, verified SIM card on the device being used, the government hopes to dismantle the infrastructure of anonymity that facilitates high-stakes extortion.

Anatomy of a “Digital Arrest”: Understanding the Scam

Before delving into the legalities of SIM-binding, it is essential to understand the gravity of the “digital arrest” phenomenon. Unlike traditional phishing, where a user is tricked into clicking a link, a digital arrest involves a high-pressure psychological operation. Scammers impersonate officials from the Central Bureau of Investigation (CBI), the Narcotics Control Bureau (NCB), the Enforcement Directorate (ED), or even local police departments. They contact victims via WhatsApp video calls, often dressed in uniforms and operating from setups that resemble official offices.

The victims are told that a parcel containing illegal items—such as drugs or fake passports—has been intercepted in their name, or that their bank account is linked to money laundering. The scammers then “place” the victim under “digital arrest,” demanding that they stay on camera for hours or even days, effectively isolating them from family and legal counsel. Under this duress, victims are coerced into transferring large sums of money as “security deposits” or “settlement fees.” The use of WhatsApp is central to this scam because it provides the visual “authenticity” needed to intimidate the victim while bypassing traditional telecommunication monitoring.

The Role of WhatsApp in Cyber Extortion

WhatsApp has become the preferred medium for these criminals due to its ubiquitous nature and its end-to-end encryption. While encryption protects privacy, it also creates a sanctuary for bad actors to operate without fear of real-time interception by law enforcement. Furthermore, the current registration process for WhatsApp only requires a one-time password (OTP). Once the account is activated, the physical SIM card can be removed or discarded, and the account remains active via Wi-Fi. This allows international scam syndicates to use Indian numbers without being physically present in the country or having an active cellular connection.

The Legal Justification for SIM-Binding

The Centre’s submission to the Supreme Court emphasizes that SIM-binding would ensure that a WhatsApp account is functional only when the associated SIM card is active and present in the device. From a legal standpoint, this introduces a layer of “Hardware-Software-Identity” linkage. If the SIM is deactivated or moved, the WhatsApp account would theoretically cease to function on that specific device for that number.

This proposal aligns with the broader objectives of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The government argues that intermediaries have a “due diligence” obligation to prevent their platforms from being used for illegal activities. By enforcing SIM-binding, the government is essentially asking WhatsApp to move toward a “Know Your Customer” (KYC) model similar to that used by banking and financial institutions.

The Supreme Court’s Purview

The Supreme Court is currently examining these submissions within the context of several petitions concerning cyber security and the regulation of encrypted platforms. The Court’s primary concern is to balance the fundamental Right to Privacy, as enshrined in the landmark Justice K.S. Puttaswamy (Retd.) v. Union of India judgment, with the State’s compelling interest in preventing crime and maintaining public order. The Centre argues that SIM-binding is a “least intrusive” measure that does not break encryption but strengthens identity verification.

Technical and Operational Implications of SIM-Binding

To understand the legal efficacy of the Centre’s proposal, we must look at how SIM-binding works in practice. Currently, several Unified Payments Interface (UPI) applications in India already use SIM-binding. When you register for a banking app, the app sends a silent SMS from the SIM card present in the phone to verify that the number matches the registered account. If the SIM is removed, the app locks out the user.

Applying this to WhatsApp would mean that the app would periodically “ping” the SIM card to ensure its presence. For the legal system, this provides a clearer trail of accountability. If a “digital arrest” scam is traced to a specific number, law enforcement can be reasonably certain that the crime was committed using a device that had that specific physical SIM card inserted. This significantly reduces the ability of scammers to use “burner” numbers or virtual numbers obtained through third-party apps.

Curbing International Syndicates

A significant portion of digital arrest scams originates from across the borders or from “cyber-slums” where thousands of pre-activated SIMs are used. SIM-binding, coupled with stricter KYC norms for SIM card issuance (as recently mandated by the Department of Telecommunications), creates a multi-factor authentication environment. It makes the “cost of business” for scammers much higher, as they can no longer simply rotate numbers on the same device without possessing the physical, active SIM cards.

The Privacy vs. Security Debate: A Constitutional Challenge

As a Senior Advocate, I anticipate that any move toward mandatory SIM-binding will be met with significant legal challenges. The primary argument against it will be the potential for increased state surveillance and the erosion of anonymity. Anonymity is often a prerequisite for free speech, particularly for whistleblowers, journalists, and activists.

The Proportionality Test

The Supreme Court will likely apply the “proportionality test” to the Centre’s proposal. For a restrictive measure to be valid, it must meet four criteria:

1. It must be sanctioned by law.

2. It must have a legitimate state aim (preventing fraud).

3. There must be a rational connection between the measure and the aim.

4. The measure must be the least restrictive way to achieve the goal.

The Centre will argue that SIM-binding is strictly a verification tool and does not allow the government to read messages or listen to calls. Therefore, the impact on privacy is minimal compared to the massive financial and psychological harm caused by digital arrest scams, which have reportedly bilked Indian citizens of hundreds of crores of rupees.

Integration with the Digital Personal Data Protection (DPDP) Act, 2023

The implementation of SIM-binding must also be viewed through the lens of the newly enacted Digital Personal Data Protection (DPDP) Act. WhatsApp, acting as a “Data Fiduciary,” would be responsible for handling the SIM-related data with the utmost care. The Act mandates that data collection must be for a “lawful purpose” and “necessary” for that purpose. The government’s stance is that verifying the identity of a user on a communication platform is a necessary step for the “prevention, detection, and investigation” of offenses, which is an exempted category under certain provisions of the DPDP Act.

However, the challenge lies in the potential for “function creep”—where data collected for the purpose of preventing scams is later used for other forms of profiling or tracking. The legal framework must include robust safeguards to ensure that SIM-binding data is used exclusively for identity verification and is not accessible for unauthorized surveillance.

Global Context and Precedents

India is not alone in grappling with the misuse of encrypted platforms. Many jurisdictions are moving toward stricter identification requirements for OTT services. However, India’s proposal for SIM-binding is among the most technologically direct interventions. In several Middle Eastern countries, VoIP services are strictly regulated and tied to national ID systems. In contrast, Western jurisdictions have focused more on “metadata” access rather than physical SIM-binding. India’s approach reflects its unique challenge: a massive, newly digitalized population that is highly vulnerable to social engineering attacks.

The “Know Your Caller” Initiative

The SIM-binding proposal is part of a broader “Know Your Caller” initiative. The Telecom Regulatory Authority of India (TRAI) has also been pushing for a Caller Name Presentation (CNP) service, which would display the KYC-registered name of a caller on the receiver’s screen. When combined with SIM-binding on WhatsApp, this would make it nearly impossible for a scammer to hide behind a fake identity or a generic “Police Department” label.

Challenges in Implementation

Despite the Centre’s optimism, several practical and legal hurdles remain. Firstly, many legitimate users in India use “dual-SIM” phones or frequently change devices. A rigid SIM-binding protocol could lead to “digital exclusion,” where legitimate users are locked out of their accounts due to technical glitches or SIM malfunctions. There is also the issue of “international roaming”—how would SIM-binding work for an Indian citizen traveling abroad using a local foreign SIM? These edge cases require careful technical drafting to ensure that the law does not become an instrument of harassment for the common man.

The Burden on Intermediaries

WhatsApp and its parent company, Meta, have historically resisted measures that require them to alter the fundamental architecture of their app for specific markets. They may argue that SIM-binding is technically unfeasible for their global codebase or that it violates their user privacy agreements. The legal battle here will likely center on Section 79 of the IT Act, which provides “safe harbor” protection to intermediaries. The government could argue that if WhatsApp fails to implement SIM-binding, it loses its safe harbor protection and becomes liable for the scams perpetrated on its platform.

Conclusion: A Necessary Step Toward a Secure Digital India

The proposal to link WhatsApp accounts to active SIM cards is a bold, if controversial, attempt to tackle the scourge of digital arrest scams. From a legal perspective, it represents an evolution of the “duty of care” that digital platforms owe to their users. In a country where a single WhatsApp call can lead to a family losing their life savings, the argument for absolute anonymity is increasingly difficult to sustain against the requirement for accountability.

As the Supreme Court deliberates on this matter, the legal community must advocate for a balanced approach. We need regulations that empower law enforcement to dismantle criminal networks while ensuring that the digital rights of 1.4 billion Indians are not compromised. SIM-binding may not be a silver bullet, but as part of a comprehensive legal and technical strategy—including public awareness, stricter KYC, and international cooperation—it could significantly turn the tide against the “digital arrest” epidemic. The final judgment of the Apex Court will likely set a global precedent for how democracies manage the tension between encrypted communication and the rule of law.

In the interim, the message from the Centre is clear: the era of consequence-free anonymity on communication platforms is drawing to a close, and the safety of the citizen is being prioritized over the convenience of the platform. As practitioners of law, we must prepare for a regime where digital identity is as legally binding and verifiable as its physical counterpart.