- Linking mobile phone lines to the CURP (Unique Population Registry Code) is mandatory in Mexico and has a deadline.
- If registration is not completed, the line will be suspended and will only be available for emergencies.
- Only basic data such as name, CURP and number are associated; biometric data is not stored.
- Experts and users warn of data leak risks and limited effectiveness against crime
El Mandatory registration of mobile phone lines with the CURP It's already a reality in Mexico and has sparked intense public debate about security, privacy, and the effectiveness of the measure. Millions of users are being forced to link their phone numbers to their official identity if they want to continue using calls, SMS, and mobile data normally.
The authorities argue that this linking telephony with the Unique Population Registry Code It is a key piece in the fight against extortion and fraud, while civil organizations, cybersecurity experts and even public figures warn of possible vulnerabilities, data leaks and a limited impact on real crime.
How does the CURP phone registration work and who should do it
The rule establishes that any mobile line that allows you to make calls, send SMS or use voice over internet It must be identified with a natural or legal person. This includes both postpaid and prepaid contract lines and eSIMs offered by operators such as Telcel, Movistar, AT&T, Bait, Altán, and other companies present in the country.
The registration falls within the Guidelines for the Identification of Mobile Telephone LinesPublished in the Official Gazette of the Federation, the measures are based on reforms to the Federal Telecommunications and Broadcasting Law. Their stated objective is to eliminate the use of anonymous SIM cards, which for years have facilitated bank fraud, identity theft, virtual kidnappings, and extortion calls.
In practice, the procedure consists of associate each number with a name and a CURP (or, in the case of companies, to an RFC). The Telecommunications Regulatory Commission (CRT) has insisted that a centralized registry is not being created in the hands of the State, but rather that the operators themselves store the information in their usual commercial systems.
Furthermore, the process officially began in January 2026 and remains active as the deadline approaches. deadline set for June 2026This has led to a flood of notices from companies to their customers reminding them that they must catch up in order not to lose service.
Deadlines, consequences, and what happens if you don't register your line
The regulation establishes that the telephone registration with CURP It must be completed before June 30, 2026From that moment on, any number that is not properly linked will have its use automatically restricted by the corresponding operator.
If the user lets the deadline pass, Your line will be suspended for most servicesYou will not be able to make or receive regular voice calls, send or receive SMS messages, and you will not have mobile data available to browse the internet through the operator's network.
The only functionality that remains active in those circumstances is access to emergency calls and citizen service numbersas well as the option to contact the telephone company itself to finalize the pending registration. No additional fines or criminal penalties are contemplated; the "punishment" consists of losing almost all the line's features.
The CRT emphasizes that, once the procedure is completed and the line is associated with the required data, Service is restored to normalHowever, the risk of being without a working phone for days has generated concern, especially among those who depend on their mobile phone for work or to receive bank verification codes.
Requirements, necessary documents and steps to link your number
One of the most frequently asked questions revolves around What documentation is required for telephone registration with CURP? and if it is necessary to provide highly sensitive data. Authorities and operators agree that the procedure has been designed with a moderate level of rigor, at least on paper.
For individuals, operators generally request the following data and documents:
- Full name of the line holder.
- curp or, as the case may be, an equivalent official identification.
- Phone number that is intended to be registered.
- Valid official identification, such as INE or passport, which is scanned or photographed.
In the case of companies and other legal entities, in addition to the above information, it is required to provide the Federal Taxpayer Registry (RFC)with the aim of associating blocks of corporate lines with an identifiable entity. For resident or temporary foreigners, options such as the following are considered: valid passport or temporary CURP.
The process can be carried out in two main ways: in person at care centers from the companies or through digital platforms and mobile applicationsIn the latter case, additional verification is usually requested using photographs of both sides of the document and a selfie of the user to confirm that the person registering the line matches the person on the identification.
Some operators limit remote registration attempts: if identity is not validated after several failed attempts, The system blocks online registration and forces you to physically go to a storeThis has been criticized by users who live in rural areas or have mobility difficulties.
Data that is stored, the role of the operators and access by the authorities
One of the messages that both the CRT and the telephone companies repeat most often is that No biometric data is collected or stored within the framework of this line registration. That is, fingerprints, iris scans, and facial databases are not stored.
According to official explanations, during the online connection process a “proof of life”This involves asking the user to take a photograph or a short video while moving their head or making certain gestures. The system compares this image with the one on their identity document to prevent identity theft using stolen photos or images generated by artificial intelligence, and then deletes the files.
The operators insist that only basic identification dataName, CURP or equivalent document, telephone number and, where applicable, RFC. This information is integrated into its own customer databases, protected under the Federal Law on the Protection of Personal Data, and is not centralized in a single state registry.
Regarding access by the authorities, the official position is that police, prosecutors, or other justice bodies will only be able to request information about a line within the framework of specific investigations and through established legal channels. Therefore, there would not be massive or indiscriminate access to all records.
Even so, groups specializing in digital rights point out that Mexico still has a long history of problems. history of leaks of large databases and they denounce a lack of transparency regarding who can access this information, under what circumstances, and with what independent controls.
Who is required, exempt, and limits on the number of lines
The registration requirement does not affect all users equally. The regulations contemplate several Exceptions and nuances depending on the type of line and the account holder's profile, with the aim of adapting the measure to different realities of telephone use.
The following are exempt from registration: SIM cards that do not allow you to make voice calls, send SMS messages, or make internet callsThis is the case, for example, with certain Internet of Things devices or some pure data plans that only serve for browsing on tablets or routers without voice capability.
Certain things are also excluded business lines of public agencies, emergency services and citizen assistance numbers, which are already identified at the source and managed under other specific legal frameworks.
In the case of minors, the line is not directly linked to the child or adolescent, but rather It must be registered in the name of the father, mother, or guardian.who acts as the legal representative. In this way, the same adult can have several lines associated with them, for example, for their children or other relatives.
Some operators have set an approximate limit of ten lines per person To prevent the widespread use of anonymous SIM cards under a single account holder. However, this number may vary slightly depending on the company and the terms of its corporate contracts.
Official reasons: fight against extortion, fraud and disposable chips
The Mexican government and the CRT frame this telephone registration with CURP within a public safety strategy which aims to reduce the number of crimes committed through calls and messages.
The central argument is that the anonymity in the purchase and activation of SIM cards It favors practices such as telephone extortionSMS bank fraud, "tech support" scams, and so-called virtual kidnappings are all examples. If each line is associated with a specific person or company, it theoretically becomes easier to trace the origin of the criminal communications.
Another of the stated objectives is to improve the traceability of calls and messages that are part of criminal investigations. With an updated registry, authorities could request the data of the owner of a suspicious line from the operators, instead of dealing with numbers impossible to link to anyone.
The measure also aims to end the sale of disposable or "use and throw away" chipsThese devices could be purchased with virtually no controls and were discarded after a crime was committed. At the same time, efforts are underway to standardize existing postpaid contract standards, extending them to prepaid lines and new technologies such as eSIMs.
Finally, the authorities emphasize that, unlike previous attempts such as the defunct RENAUT, A single, large, state-managed database has not been created.Instead, the information is distributed among private operators under existing data protection frameworks.
Criticisms, safety concerns, and comparison with previous experiences
Alongside the official discourse, numerous critical voices have emerged questioning whether this Registering phone numbers with CURP will significantly curb crime and they warn that it may create more problems than it solves.
Cybersecurity specialists and digital rights organizations point to the following as their main concern: risk of leaks and theft of personal dataThe combination of name, CURP (Mexican national ID number), and phone number is especially sensitive, as it allows for highly targeted phishing campaigns or cross-referencing information with other databases leaked on the black market.
There is also an alert about possible cases of identity impersonationIn these cases, criminals manage to register a phone line in someone else's name, so that future investigations point to innocent victims. According to these experts, current verification systems may not be robust enough to prevent this in all cases.
Another recurring criticism is the lack of clarity regarding controls and audits These measures will apply to operators and authorities requesting access to the information. Without robust independent mechanisms, they fear the data will be used for political, commercial, or surveillance purposes outside the scope of the law.
The memory of RENAUT, whose mobile phone user registry was leaked and illegally sold, looms over the debate. Many of the organizations that opposed that registry at the time believe that The mistakes of the past have not been completely corrected and that citizens continue to bear the risk.
Impact on apps like WhatsApp and the rise of alternatives
One of the most frequently asked questions by users is to what extent this Registration with CURP will affect the use of messaging applications such as WhatsApp, which have become the main means of communication for a large part of the population.
For now, as long as the line remains active, WhatsApp continues to function normally, even if the device only connects to the internet via Wi-Fi. However, the CRT has hinted at the possibility of promote additional regulation that requires any WhatsApp account to be backed up by a SIM card registered in the name of its user.
Authorities have acknowledged that they already exist conversations with the company that owns the application to explore ways to collaborate, although no specific timelines or concrete measures have been detailed yet. In practice, such a change would mean that accounts linked to unregistered numbers could stop working.
Given this situation, some content creators and entrepreneurs have publicly expressed their rejection of linking their line to the CURP (Unique Population Registry Code) and have begun to explore alternatives such as foreign eSIMs or virtual services that operate within Mexico but are contracted to operators from other countries.
The CRT has detected an increase in the contracting of these services outside of national regulation, which opens a new front: the potential exodus of users to international solutions which largely escape the control of Mexican authorities and further complicate the objective of tracing all communications.
Vulnerabilities, most affected groups, and slow registration rate
Beyond the legal and political debates, the rollout of the CURP-based telephone registration system is revealing a series of practical vulnerabilities and side effects that affect different user groups unequally.
One of the most delicate points is that of the people who They cannot easily prove their identityCitizens without updated documents, inhabitants of rural areas far from care centers, or people in situations of social vulnerability who do not fit well into formal administrative circuits.
For all of them, the requirement to physically appear with valid identification or to pass online verification processes with a good connection and a suitable device becomes a barrier that can limit their access to mobile telephony and basic digital services.
Added to this is the concern about the lack of clear procedures for correcting errors in the stored data. Users and associations have reported that if registration is done with a misspelled CURP or with the wrong document, the process to rectify the information can be slow and complicated, leaving the line blocked for days or weeks.
Meanwhile, estimates regarding the progress of the census indicate that The rate of discharges is lower than necessary. To meet the deadline with all lines regularized, calculations published by specialized media indicate the need to register hundreds of thousands of numbers per day to achieve the goals, something that currently seems difficult.
This delay has fueled the feeling that the project could stall halfway through, with a large number of legitimate users affected and no guarantee that the real criminals will stop using alternative methods such as foreign chips or anonymization tools.
Given all this context, registering a telephone number with the CURP (Unique Population Registry Code) has become a a genuine point of friction between the security agenda and the protection of personal dataWhile the government insists that the measure seeks to protect citizens from extortion and fraud, numerous voices are calling for greater technical guarantees, independent oversight mechanisms, and a constant evaluation of its real results to avoid repeating past mistakes and not placing the burden of the experiment exclusively on ordinary users.
