Skip to content
Try one-tap loginBook a demo

SIM and device binding

Tie each account to the customer’s own phone and SIM. Any other phone or SIM has to prove it is them first.

Book a demoTry one-tap login
The account is bound to this phone and SIM 1. Any other phone has to step up first.

Your customer’s account, on their own phone.

SIM binding ties the account to the SIM that holds the number. Device binding ties it to one phone. DeepID does both at sign-up, so a login or a payment from anywhere else is a change you see.

It comes in the same SDK as the rest of DeepID’s login, with no new screen for the customer. When the phone or SIM changes, they prove it is them before anything is bound again.

Wherever the phone is the key.

One binding at sign-up keeps each account on its owner’s phone and SIM, so a takeover can’t start from another device.

Banking, Insurance, NBFC, Government, Payments, each wired to DeepID.

SIM binding is becoming the rule in India.

UPI apps already bind to the SIM, and the Department of Telecommunications has directed messaging apps to work only while the registered SIM is in the phone, from 1 January 2027 (Firstpost, press report). DeepID supports the control and never guarantees compliance.

Read the guide

How it works.

Bound once at sign-up, then checked at every login and payment. A new phone or SIM is bound only after the customer proves it is them.

A change of phone or SIM reaches your app as device.change. The events, one per moment

What you get.

Nothing new for the customer to do, and one more thing a fraudster can’t fake.

  • One phone, one SIM, one account

    A login from any other phone or SIM is a change the bank sees, not a customer it trusts.

  • A moved SIM is caught

    A swapped or ported SIM is not the bound one, so the session steps up to a face check.

  • Re-binding the owner can pass

    A new phone is bound again only after the face from sign-up holds. A fraudster can’t pass that.

  • A cool-off after any change

    What can leave the account is held low for as long as your policy and market set.

One SDK. Bound from the first session.

Android, iOS, React Native, Flutter, Web. One call at sign-up, login and payment.

Talk to us

Why phones need binding.

Most takeovers start with a number on someone else’s SIM, or the app on someone else’s phone.

  1. How takeovers start

    A fraudster ports the number to a new SIM, or talks the customer into installing the app on a phone they control, then signs in as them.

  2. Where checks fall short

    A code goes to whichever SIM holds the number, and a password works on any phone. Neither asks whether this is the customer’s own device.

  3. What binding changes

    The account answers only to the phone and SIM bound at sign-up. Anything else has to prove it is the customer first.

Change the SIM or phone, and binding steps in.

A changed SIM or phone is where takeovers start, so binding answers each one.

  • SIM pulled or swapped

    The number turns up in a phone that isn’t the bound one. The session stops for a face check before anything else.

  • Re-bound to a new phone

    The owner’s face from sign-up holds first. Then the new phone and SIM are bound, with a cool-off on what can leave.

  • Sent to your systems

    Each change reaches your app and FRM as one event with its reasons, like SIM_MOVED or NEW_DEVICE.

The SIM and device binding guide

In the news.

India’s SIM-binding rules for messaging apps, as the press has reported them.

Read next.

Questions banks ask.

What is the difference between SIM binding and device binding?

SIM binding ties the account to the SIM registered for the number; device binding ties it to the phone. DeepID does both, so a number moved to a new SIM and a phone that is not the bound one are each a change the decision sees.

What happens on a dual-SIM phone?

The right SIM is picked, or the customer chooses which one the account binds to. The other SIM is not the bound one.

How does re-binding work when a customer gets a new phone?

The customer proves it is them with a face check against the face matched at sign-up. Then the new phone and SIM are bound, and a cool-off limits what can leave for as long as your policy sets.

Does it stop a SIM swap?

It catches one. A swapped SIM is not the SIM bound at sign-up, so the login or payment steps up to a face check against sign-up instead of going through.

Which platforms does it run on?

One SDK for Android, iOS, React Native, Flutter and Web. Binding runs in the same call as the rest of the login.

Is SIM binding required in India?

UPI apps already bind to the SIM, and in November 2025 the Department of Telecommunications directed messaging apps to work only while the registered SIM is present and active, with a deadline reported as 31 December 2026. DeepID supports the control and never guarantees compliance.

Try one-tap login on your own number.

See the network confirm your number with nothing to type, and the next check take over when it can’t. Then plan a shadow proof on one journey, measured on your own traffic.

Try one-tap loginBook a demo