India mandates registered caller name display (CNAP) on 4G and 5G networks from November 1

India's Department of Telecommunications has instructed every licensed access provider to switch on Calling Name Presentation (CNAP) across all service areas from November 1, 2026. The circular, dated October 13, covers wireless networks built on 4G and later technologies, while 2G, 3G and fixed-line networks will be considered separately. On each incoming call the handset shows the number and then a name: the contact name if the recipient has saved the number, otherwise the name in the originating operator's subscriber record, or "International Call" for calls from abroad. Originating operators must maintain a name-to-number database for terminating operators to query, and the name must not be retained after the call ends. Business and bulk users can present a verified registered trade mark or GST trade name instead. Callers who use calling line identification restriction will not have their name shown. The move follows TRAI recommendations from February 2024.

Why it matters

CNAP turns the subscriber's KYC record into an identity assertion delivered with every call, which raises the cost of vishing from unknown numbers that pose as banks, police or support desks. It is a weak assertion, though. It is only as accurate as the operator's onboarding, it says who registered the SIM rather than who is speaking, it does not cover 2G, 3G or landlines yet, and calls placed over internet messaging apps are not carried on the operators' voice networks it addresses.

For identity teams with users or staff in India, the practical point is to keep the displayed name out of any verification decision. A help desk or fraud team that treats "the screen showed the right name" as proof of identity has swapped one spoofable signal for another. Keep call-back to a number on file and out-of-band verification for resets, as covered in help-desk social engineering.

Source: The Hacker News