India mandates registered caller name display (CNAP) on 4G and 5G networks from November 1
India's Department of Telecommunications has ordered all access providers to show callers' subscriber-registered names on incoming calls from November 1, 2026, a network-level identity signal aimed at spam and fraud calls.
India's Department of Telecommunications has instructed every licensed access provider to switch on Calling Name Presentation (CNAP) across all service areas from November 1, 2026. The circular, dated October 13, covers wireless networks built on 4G and later technologies, while 2G, 3G and fixed-line networks will be considered separately. On each incoming call the handset shows the number and then a name: the contact name if the recipient has saved the number, otherwise the name in the originating operator's subscriber record, or "International Call" for calls from abroad. Originating operators must maintain a name-to-number database for terminating operators to query, and the name must not be retained after the call ends. Business and bulk users can present a verified registered trade mark or GST trade name instead. Callers who use calling line identification restriction will not have their name shown. The move follows TRAI recommendations from February 2024.
Why it matters
CNAP turns the subscriber's KYC record into an identity assertion delivered with every call, which raises the cost of vishing from unknown numbers that pose as banks, police or support desks. It is a weak assertion, though. It is only as accurate as the operator's onboarding, it says who registered the SIM rather than who is speaking, it does not cover 2G, 3G or landlines yet, and calls placed over internet messaging apps are not carried on the operators' voice networks it addresses.
For identity teams with users or staff in India, the practical point is to keep the displayed name out of any verification decision. A help desk or fraud team that treats "the screen showed the right name" as proof of identity has swapped one spoofable signal for another. Keep call-back to a number on file and out-of-band verification for resets, as covered in help-desk social engineering.
Source: The Hacker News
Related on Start with Identity
- BlogDexcom says targeted vishing calls led to access to internal documents
Glucose monitor maker Dexcom says targeted voice phishing gave an unauthorized party access to limited information in certain internal documents. It reports no
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a
- BlogA service sold 153 million driver's licenses scraped from an identity verification vendor
Nexus, advertised on a Russian cybercrime forum, sold access to more than 153 million US and Canadian driver's licenses that its operators say they exfiltrated
- GlossaryCalling Name Presentation (CNAP)
Calling Name Presentation (CNAP) is a telephone network service that shows the called user the caller's name, supplied by the network rather than by the caller,
- CVEBeyondTrust Remote Support zero-day, from file upload to the whole credential vault
An origin-validation flaw in self-hosted BeyondTrust Remote Support through 26.2.3 let ARMORY CASTLE plant a web shell, export every vaulted admin credential, a
- VendorCato Networks
top_tier