WhatsApp’s username revolution hits a scam speed bump: India puts privacy push on pause

WhatsApp's introduction of username reservations marks a significant shift in user privacy by enabling contact without the need to share sensitive phone numbers, a practice that has been foundational since the app's inception 17 years ago. This feature allows both individuals and businesses to maintain greater control over their personal information while still being easily reachable, addressing long-standing privacy concerns associated with phone number exposure.

The username reservation process is designed to be intuitive and user-friendly, with in-app prompts and suggestions that help users secure unique handles effortlessly. Users can claim, edit, or delete their usernames directly through the app settings, and even set a four-digit key to add an extra layer of security for new contacts initiating communication via username, blending convenience with thoughtful privacy controls.

For businesses, adopting WhatsApp usernames offers a more professional and accessible means of customer interaction, simplifying outreach by replacing phone numbers with memorable, brand-consistent handles. This is further enhanced by the ability to link usernames across Meta platforms like Instagram and Facebook, allowing small businesses and side hustles to maintain a cohesive digital identity and streamline customer engagement.

Meta's proactive move to open username reservations ahead of the full feature rollout underscores the company's commitment to a seamless transition, encouraging users to secure their preferred identifiers early. This pre-release strategy not only reduces potential conflicts over popular usernames but also reflects the scale of this update, which impacts WhatsApp's massive user base of three billion people worldwide.

The rollout of WhatsApp usernames has sparked significant concerns over impersonation and scam risks, as scammers can easily create lookalike handles with minor variations—such as 'warikoo' versus 'awarikoo'—to deceive users into fraudulent schemes ranging from fake customer care to cryptocurrency and romance scams. Entrepreneur Ankur Warikoo highlighted this vulnerability by illustrating how subtle changes in usernames can solicit money under false pretenses, while cybersecurity lawyer Prashant Mali warned that deepfake-assisted messages combined with fake usernames could further amplify these threats.

While WhatsApp’s username feature enhances privacy by hiding phone numbers, it fundamentally shifts the trust model, making it harder for users to verify identities and increasing susceptibility to cyberfraud. Experts like Prashant Mali and Prof Sajith Narayanan emphasize that usernames from unknown senders offer little insight into the sender’s true identity, complicating trust establishment and potentially undermining the security benefits of privacy. This shift also reduces traceability for law enforcement, as usernames obscure the SIM and KYC trails that phone numbers provide, potentially aiding organized fraud operations.

Regulatory scrutiny in India has intensified, with the Ministry of Electronics and Information Technology halting WhatsApp’s username rollout and demanding explanations from Meta, Signal, and Telegram about their safeguards against impersonation and cyberfraud. This early governmental intervention reflects concerns not only about privacy but also about abuse prevention and traceability, especially as WhatsApp expands into payments and business communication. Cyber law expert Pawan Duggal underscores the necessity for Meta to comply strictly with India’s data protection laws, including the Digital Personal Data Protection Act 2023, to mitigate privacy violations linked to usernames.

Meta’s approach to mitigating impersonation risks—such as reserving usernames for public figures and labeling messages—places much of the responsibility on users, which may inadequately protect vulnerable groups like the elderly or new internet users. Moreover, linking WhatsApp usernames with Facebook and Instagram accounts via Meta’s Accounts Center raises the stakes by enabling social engineering and targeted fraud through cross-platform identity correlation. Experts advise users to choose unique WhatsApp-only usernames and leverage privacy settings like username keys and contact restrictions to reduce impersonation risks, as some high-profile usernames resembling politicians and celebrities remain available, posing ongoing challenges.

In response to growing concerns over fraud and impersonation risks, the Indian government, through the Ministry of Electronics and Information Technology (MeitY), has paused WhatsApp's rollout of usernames, demanding that Meta engage in consultations with the Ministry of Home Affairs and other messaging platforms before resuming. This regulatory intervention underscores the government's cautious approach to new identity features on platforms like WhatsApp, which serve hundreds of millions of users and are deeply integrated into business, payments, and social communication in India. The pause reflects a broader scrutiny of how usernames might alter traditional contact and discovery flows, potentially complicating law enforcement efforts.

WhatsApp has sought to address regulatory and user concerns by releasing detailed FAQs clarifying that usernames are optional and serve as unique identifiers that can replace phone numbers in certain contexts, yet a phone number remains mandatory for account creation. This dual system aims to balance enhanced privacy—by protecting phone numbers from direct exposure—with accountability, as the phone number still anchors the account's identity. However, regulators remain wary that usernames obscure the traceability inherent in phone numbers, which link to SIM cards, telecom operators, and KYC records, thus potentially weakening law enforcement's ability to track digital fraud.

To mitigate impersonation and fraud risks, WhatsApp plans to implement safeguards such as labeling messages from new or suspicious contacts, indicating whether the sender is new, shares common groups, or is in the recipient’s contact list. Despite these efforts, Indian regulators express skepticism about the effectiveness of such signals, particularly for vulnerable groups including the elderly, new internet users, and those under social pressure, who may not fully grasp or utilize these indicators. This highlights the ongoing tension between introducing user-friendly privacy features and ensuring robust protections for all segments of the population.