In Indian banking, the registered mobile number is more than a contact detail. It receives OTPs, transaction alerts, and password resets. Whoever holds the number can often control the account.
That creates a quiet risk. Mobile numbers are disconnected every day for failed re-verification, links to cybercrime or plain non-use, and many are later reassigned. If a bank still treats a revoked number as its customer’s, OTPs can reach a stranger, and accounts linked to fraud-flagged numbers can keep operating.
The Mobile Number Revocation List (MNRL) exists to close that gap. This guide explains what MNRL is, what RBI expects, and how to implement it without disrupting genuine customers.
What MNRL Is
MNRL stands for Mobile Number Revocation List. It is a list of mobile numbers that have been permanently disconnected, compiled from telecom service providers and published by the Department of Telecommunications (DoT) through its Digital Intelligence Platform (DIP).
DIP is DoT’s secure platform for sharing telecom-related fraud intelligence with stakeholders such as banks, payment providers, and law enforcement. Regulated entities access MNRL data through DIP, either by periodic download or integration.
Why Mobile Numbers Get Revoked
Numbers appear on the list for reasons that carry different risk levels:
- Failed re-verification: The subscriber could not be re-verified, often because the SIM was obtained with fake or borrowed documents.
- Cybercrime or misuse: The number was disconnected after being linked to fraud, often following reports on DoT’s citizen-facing Chakshu facility or law-enforcement input.
- Excess SIMs: Connections above the permitted number per individual were disconnected.
- Non-use or surrender: The subscriber stopped using or surrendered the connection.
The first two categories are strong fraud signals. The last is mostly benign but still means the number no longer reliably reaches the customer.
The RBI Requirement
In January 2025, RBI advised regulated entities to use MNRL, available on DoT’s Digital Intelligence Platform, to clean their customer databases and monitor accounts linked to revoked numbers, with action expected by 31 March 2025.
RBI asked entities to build standard operating procedures that include:
- updating registered mobile numbers after due verification when a revoked number is found; and
- enhanced monitoring of accounts linked to revoked numbers, specifically to prevent them from being operated as money mules or used in cyber fraud.
The same communication covered related steps, such as sharing verified customer-care numbers with DoT and using designated number series for transactional and promotional calls.
Risks MNRL Helps Control
| Risk | How it happens | How MNRL helps |
|---|---|---|
| OTP interception after reassignment | A disconnected number is reissued to a new person who receives the old customer’s OTPs | Flags the number so it can be replaced before reuse |
| Mule account operation | Accounts opened or controlled with SIMs later cut for fraud | Identifies accounts tied to fraud-linked numbers for review |
| Loan and onboarding fraud | Applications using numbers already revoked | Blocks or escalates at onboarding |
| Failed customer communication | Alerts sent to numbers the customer no longer holds | Prompts contact-detail updates |
The value is highest when MNRL is used continuously, not as a one-time clean-up.
How to Implement MNRL Checks
A complete implementation covers three moments.
At onboarding
Check the applicant’s mobile number against MNRL before the OTP step completes. A revoked number should stop the journey or route it to an alternative verification path.
Portfolio screening
Screen all registered mobile numbers against each MNRL update. Matches create a work queue by risk category.
At sensitive events
Re-check before high-risk actions: change of registered mobile number, new device registration, high-value payee addition, loan disbursal, and large withdrawals.
Behind all three, keep an audit trail: when each number was checked, against which list version, and what action was taken.
Handling a Match Without Harming Customers
An MNRL match is a trigger for action, not proof of fraud. A disciplined SOP separates cases:
- Suspend OTP-based actions on the revoked number immediately, so no new holder can use it.
- Classify the reason where available. Fraud-linked revocations go to enhanced monitoring and investigation; routine ones go to contact update.
- Reach the customer through other channels: email, alternate phone, branch, or app notification.
- Update the number after due verification, for example through branch, V-CIP, or an authenticated channel, not by accepting a new number over an unverified call.
- Monitor linked accounts for mule patterns, and escalate to STR review where activity is suspicious.
Avoid blanket account freezes for routine revocations. They create complaints and can block legitimate customers from their own money.
MNRL Alongside Other Telecom Risk Signals
MNRL tells you a number is gone. Other signals tell you a live number is risky:
- Number age and tenure: Very new numbers are common in fraud applications.
- Recent SIM swap or port: A frequent precursor to account takeover.
- Name match with telecom records: Whether the number appears to belong to the applicant.
- DoT fraud risk indicators: DoT has introduced risk classification of numbers through DIP for financial institutions, which complements MNRL for live numbers.
Combining these signals produces a mobile risk view that is far more useful than a single list check.
Use Cases
Retail bank: Screens its full customer base against each MNRL update, freezes OTP delivery to matched numbers, and runs a contact-update campaign through branches and email. Fraud-linked matches go to the financial crime team.
Digital lender: Blocks applications with revoked numbers at onboarding and adds number age and SIM-swap checks for new numbers.
Payments app: Re-checks MNRL before registered mobile changes and new device bindings, cutting account takeover attempts that relied on reassigned numbers.
Key Takeaways
- MNRL is DoT’s list of permanently disconnected mobile numbers, shared through the Digital Intelligence Platform.
- RBI has required regulated entities to use MNRL to clean customer data and monitor accounts linked to revoked numbers.
- Use MNRL at onboarding, in regular portfolio screening, and before sensitive account events.
- Treat a match as a trigger: stop OTPs, classify the reason, re-verify through another channel, and monitor for mule activity.
- Pair MNRL with live-number risk signals such as tenure, SIM swap, and telecom name match.
Frequently Asked Questions
How often should MNRL checks run?
At onboarding, before sensitive account changes, and against the full customer base whenever the list is updated.
Does an MNRL match mean the customer is a fraudster?
No. Numbers are revoked for many reasons, including non-use. The match means the number should no longer be trusted, and the reason should be reviewed
Is MNRL mandatory for banks?
RBI has advised regulated entities to use MNRL and to set up SOPs for handling revoked numbers, with action expected from March 2025.
Who publishes the MNRL?
The Department of Telecommunications, through its Digital Intelligence Platform, uses data from telecom service providers.
What is the full form of MNRL?
Mobile Number Revocation List.
Conclusion
MNRL addresses a simple but costly weakness in digital finance: institutions trusting a mobile number long after it has stopped belonging to their customer. RBI’s requirement turns that weakness into a defined control with clear expectations.
The institutions that get the most from it use MNRL continuously, handle matches with a careful SOP, and combine it with live mobile risk signals.
BeFiSc’s mobile intelligence APIs help regulated entities check revocation status and related mobile risk signals at onboarding and at key account events. Talk to the BeFiSc team to add mobile risk checks to your stack.
