WhatsApp Usernames Spark Impersonation Fears in India
WhatsApp has initiated a phased rollout of a username reservation system, allowing users to connect via handles rather than traditional phone numbers. While Meta frames this as a significant privacy upgrade, the feature is already under intense scrutiny in India—the platform’s largest market with over 500 million users—due to fears that it could become a tool for widespread digital fraud.
The transition moves the platform away from phone numbers as the primary identifier. Security experts and government officials warn that this shift may inadvertently lower the barrier for bad actors to conduct phishing, “digital arrest” scams, and impersonation attacks, as users could be contacted by accounts masking their true identity.
Regulatory Scrutiny and Security Risks
The Indian Ministry of Electronics and Information Technology (MeitY) has formally intervened. In a notice reviewed by reporters, the ministry expressed concern that the feature could increase online fraud by enabling attackers to reach users without exposing their phone numbers. The government has directed WhatsApp to pause the rollout until consultations are complete and to explain why regulatory action under local IT laws should not be initiated.
The potential for abuse is illustrated by early testing, which revealed that handles mimicking high-profile entities remain available for reservation. Examples include:
- Political figures and institutions: “indiamodi” and “rbi_verify”
- Celebrities: “shahrukh.actor” and “teamamitabh”
- Corporate brands: “ambanijio”
Separately, Binance founder Changpeng Zhao noted on X that he was unable to reserve his established handle, “cz_binance,” highlighting potential inconsistencies in how the platform manages identity claims.
Meta’s Response and Industry Debate
Meta maintains that it proactively reserves handles for government entities, public figures, and specific variations to prevent unauthorized claims. However, the company has not disclosed the specific criteria used to determine which names receive this protection.
The government’s heavy-handed approach has also faced criticism. The Internet Freedom Foundation (IFF) argued that the ministry’s directive lacks a clear legal basis and risks granting the executive branch excessive control over product design. “Impersonation and fraud are real risks, but they are met by enforcing the criminal law against those who commit them,” the group stated.
This tension mirrors previous judicial observations in India regarding Telegram, where courts noted that username-based systems could complicate the task of identifying those spreading illicit content.
Privacy Trade-offs
Industry experts offer mixed perspectives on the change:
- Privacy Gains: Rachel Tobac, CEO of SocialProof Security, suggests that usernames are a net positive for privacy, as they mitigate risks like SIM-swap attacks and unwanted contact from strangers. She advises users to choose non-obvious handles to minimize harassment.
- Platform Power: The Mozilla Foundation noted that while linking Instagram or Facebook usernames might reduce impersonation, it further cements Meta’s ability to unify identity across its ecosystem—without allowing users to port that identity to competing platforms.
For now, WhatsApp states it is adopting a gradual approach. The company confirmed via an FAQ on X that it is actively monitoring feedback to refine the feature ahead of its broader launch scheduled for later this year.