1. What is Device Binding?

Device Binding: Server links user account to unique hardware identifiers - IMEI, Android ID, SIM ID, TEE (Trusted Execution Environment) key, app instance ID. Even stolen session tokens can't be reused elsewhere because server expects proof from original device.

How it works:

• App generates key pair in Secure Enclave
• Public key registered with bank
• Every login/transaction signed by private key that never leaves device
• SIM Binding: UPI app reads SIM slot 1 and verifies mobile number via silent SMS

Regulatory Mandate in India:

• RBI Circular on Mobile Banking + UPI Guidelines: RBI mandates device binding for mobile banking and UPI apps
• Purpose: Prevent account takeover, SIM swap fraud.

Multi-Device Need:

• User has 2 phones (personal + work)
• Family uses same bank account on different devices
• Trader wants mobile + desktop + tablet for trading
• Loss of phone = total lockout

Conflict: Binding increases security but violates user's legitimate expectation of access.

2. Legal Dimensions of Conflict

A. Security Argument (Bank):
Under IT Act Sec 3A, 2-factor authentication mandatory. Device binding is considered "possession factor". If bank allows multi-device without binding, it is liable for unauthorized transactions under RBI's Limited Liability Circular 2017.

B. Consumer Right Argument (User):

• Consumer Protection Act 2019 - deficiency of service if user blocked from own account.
• RBI Circular 2023: Banks can't use technology to restrict device functionalities for loan defaults. RBI stated banks cannot use any tech-based mechanism to restrict or disable functionalities of borrower's mobile device

C. Privacy Argument:
Device binding collects IMEI, location - conflicts with Puttaswamy Right to Privacy (2017).

3. Emerging Regulatory Solution - Secondary Device Model

SEBI's new proposal for Trading Accounts (2025):

"The proposed framework goes beyond SIM binding and includes... Secondary Device Registration: Clients will be able to register a secondary device for trading, provided both devices remain within a 100-meter range of each other"

This is the future model banks are adopting: Primary device = full rights, Secondary device = view only or needs proximity approval.

Similarly, NPCI UPI now allows:

• 1 UPI ID can be active on max 1 device at a time (device binding)
• If you login on second device, first device auto-logs out
• Multi-device UPI app allowed only with same mobile number SIM in device

4. Case Laws

A. On Device Binding as Mandatory Security

1. Thomas Ninan & Anr. v. Axis Bank Ltd., Consumer Court 2023
Complainant responded to anonymous mail for updating internet banking and disclosed login ID, password, etc., leading to fraudulent transactions. Bank argued customer negligence and that transactions originated from bound device? Court held circular dated 06.07.2017 on limited liability applicable - but if device binding bypassed due to customer's sharing credentials, customer liable. Established that device binding is valid security measure, but bank must prove transaction originated from bound device with audit logs.

2. RBI Ombudsman Series - Unauthorised Electronic Transactions
Principle: If transaction done from device NOT bound to customer (e.g., SIM swap), bank must refund within 10 days as per RBI Zero Liability framework. If from bound device and customer shared PIN, customer liable up to Rs 25,000.

3. Kerala High Court - From Stolen Data to Frozen Bank Account - WP(C) No. 43188 of 2025, 10 July 2025
Dealing with 21-year-old account holder, Court referred to broader pattern where persons who just crossed majority opened multiple bank accounts used as money mules. Court held banks must enforce device binding + account number velocity check. If same device opens multiple accounts, trigger investigation. Justified strict binding despite inconvenience.

B. On Multi-Device Right & Single Device Restriction

4. Karnataka High Court - Video Conference Hearing Order (2023)
Court observed: "Don't use multiple devices while appearing for Video Conference hearings, use only one device to avoid disturbance". Though for court hearings, same logic applied by banks - multiple simultaneous logins create audit trail confusion. Single active device rule upheld as reasonable.

5. EU - EPO Case T 0227/18 - Supporting Multiple Instances of Same Payment Application
Technical Board held plurality of instances of same payment application (MasterCard PayPass) behind common application manager is technical as it provides technical effect of easily handling plurality of bank accounts. Patent allowed for multi-device payment. Shows IP law recognizes need for multi-device but requires secure containerization - each instance must be isolated.

C. On Signature & Device Ownership

6. Rajasthan HC - Secondary Electronic Evidence Requires Certificate from Original Device Owner
Relied on Anvar P.V. vs P.K. Basheer - Section 65B certificate must be signed by person who had control over device at time of recording. Without certificate from owner of original device, electronic record not admitted. Applied to device binding: If bank claims transaction from bound device, must produce certificate from server that controls device binding registry, not just customer app logs.

5. How to Resolve - Best Practice Framework 2025

For Banks / Fintechs:

1. Primary + Secondary Device Registration: Allow 1 primary (full transact) + 1 secondary (view + limited transact with biometric on primary).
2. Risk-Based Step-Up: If transaction from new device, trigger additional factor - not outright block.
3. Graceful Migration: Allow device migration via old device approval or branch visit with cool-off 24 hours.
4. Transparency: Show in app: "Your account bound to Device XYZ - Last active". Allow de-register.

For Users / Lawyers:
If bank denies refund saying "transaction from your bound device, so you liable":

• Demand Device Binding Logs + IP + SIM binding proof under RTI/Banking Ombudsman
• Check if bank allowed multi-device login bypass - many apps have flaw
• Argue under RBI Circular 06.07.2017 - even if device bound, if fraud reported within 3 days, zero liability

Current Law in India: Device binding is mandatory and legal. Multi-device usage is allowed only if each device is separately bound and verified with same mobile number SIM. One UPI ID cannot be active on two devices simultaneously - second login terminates first. This is considered reasonable restriction under Article 19(6).