SIM binding, device binding and silent network verification
Three checks are often spoken of as one. SIM binding ties the account to the SIM, device binding ties it to the phone, and silent network verification asks the network whether the number is in this phone right now. Each proves something different, and a bank app needs all three.
In this guide
What each one proves
A bank’s team hears all three terms in one breath, often from a regulator or an auditor. They answer three different questions, and the glossary defines each.
SIM binding
Proves: The account is tied to one SIM, matched to the registered number at sign-up. A payment from another SIM is not this customer’s.
Does not prove: A SIM moved into another phone, or a phone under someone else’s remote control.
Device binding
Proves: The account is tied to one phone, with an ID that survives a reinstall or a reset, and the phone is checked for tampering in every session.
Does not prove: The right phone in the wrong hands, or a new SIM in the same phone.
Silent network verification
Proves: The network confirms, over mobile data, that the number belongs to the SIM in this phone right now, with nothing for the customer to type.
Does not prove: A customer who is on their own phone and SIM, and being coached. Only the session shows that.
None of them, alone or together, proves that the customer is acting freely. A customer on their own bound phone, with their own SIM, confirmed by the network, can still be reading out a payee under instruction. That is a question for the session, and the subject of the guide to coached payments.
UPI: binding today
UPI onboarding binds the app to the device and needs an active SIM linked to the bank account. A new SIM or a new phone means binding again.1 Indian customers already live with the principle: a UPI app that stops working when the SIM changes is familiar to them.
The question for a bank is whether its own app applies the same principle, at registration and at every later session, or only at the UPI step.
DoT: messaging apps next
In November 2025 the Department of Telecommunications issued directions requiring app-based messaging services to work only while the registered SIM is present and active in the phone.2 The compliance date was reported in April 2026 as moved to 31 December 2026.3
The directions are context for a bank, not a bank obligation. Scam channels that relied on a messaging account running without its SIM become harder to operate, and “SIM binding” has become a term customers know and ask about.
The number, rated
DoT’s Financial Fraud Risk Indicator, introduced in May 2025, rates a mobile number as a medium, high or very high risk of financial fraud, and shares the rating with banks and UPI providers through the Digital Intelligence Platform.4 DeepID’s own number checks, such as a SIM moved to another phone or a new SIM in the same phone, sit beside that rating in your decision. No integration is claimed.
What a bank app needs
Our reading of good practice, not a legal requirement. Four steps, with what often happens today and what changes with DeepID.
Bind at registration
Confirm the SIM in the phone matches the registered number, then bind the account to that SIM and device.
- Often today
- An SMS sent from the phone, or a typed code.
- With DeepID
- The network confirms the number and the SIM is read, with nothing to type.
Check on every session
Is the bound SIM still in this phone, and is the app on it genuine?
- Often today
- Checked at login, if at all.
- With DeepID
- SIM presence and device integrity read at login, new payee and payment.
Bind again on change
A new SIM or a new phone is the start of most takeovers.
- Often today
- A new code to the same number.
- With DeepID
- A fresh check, such as a face match against the face from sign-up, before the new phone is trusted.
Cool off after a change
Lower limits for new payees for a period your policy sets.
- Often today
- Full limits from the first minute.
- With DeepID
- A cool-off decision for the risky session only.
RBI’s Authentication Directions count the bound SIM and the registered device as possession factors, and leave room for risk-based checks above them.5 The guide to the directions sets out what they ask and what they do not.
How DeepID supports it
| What is needed | The control | Module |
|---|---|---|
| An active SIM linked to the account | SIM binding at onboarding and UPI registration, confirmed by the network. | SIM and device binding |
| The app bound to the device | A device ID that survives reinstall and reset, with root, emulator, hooking and cloned-app checks. | Device intelligence |
| A changed SIM or phone | Binding again after a fresh check, and a cool-off set per journey. | Silent network verification |
| A face for the new phone or the UPI PIN | Liveness and injection checks on the capture, then Aadhaar face authentication with consent. | Liveness and face match |
Which routes are live with which network is confirmed with your team before a pilot. See the UPI payment, held before the PIN, and the SIM and device binding module. DeepID supports compliance and never guarantees it.
Sources
Secondary sources are news or trade reporting of a rule or figure. Check the regulator’s own text before relying on them. Nothing in this guide is legal advice.
- NPCI (opens in a new tab), as of Oct 2026UPI user onboarding: product overview
- The Hacker News (opens in a new tab), Dec 2025, press reportIndia orders messaging apps to work only with active SIM cards
- Angel One (opens in a new tab), 2026, press reportDoT extends SIM-binding deadline for WhatsApp, Telegram and Signal till year end
- PIB (opens in a new tab), May 2025DoT introduces the Financial Fraud Risk Indicator (FRI) to strengthen cyber-fraud prevention
- RBI (opens in a new tab), Sep 2025Press release: directions on authentication mechanisms for digital payment transactions