Days after WhatsApp started rolling out username reservations for its yet-to-be-released function, the platform appears to have run right into a regulatory hurdle in India. The brand new function, named usernames, permits individuals to search out one another by username as an alternative of cellphone quantity.
In a letter to the Meta-owned platform, the Ministry of Electronics and Data Expertise (MeitY) stated usernames may improve the situations of on-line fraud and digital arrest scams, and will unleash impersonation by permitting unhealthy actors to contact customers with out revealing their cellphone numbers. The federal government physique additionally warned that usernames resembling these of famous people, monetary establishments or authorities businesses may result in id spoofing.
That is the most recent try by the federal government to scrutinise anonymity options on messaging platforms. A couple of weeks in the past, the federal government raised comparable considerations about Telegram’s username-based messaging function and argued that hiding cellphone numbers makes it troublesome for legislation enforcement to establish customers concerned in cybercrime.
The newest standoff raises broader questions: are the federal government’s considerations justified, or do WhatsApp’s safeguards sufficiently deal with them?
What’s altering?
Ever since its inception, WhatsApp has been counting on cellphone numbers as customers’ identities. To message somebody, you must have their cellphone quantity. The brand new usernames function is actually altering that. As soon as rolled out, customers will be capable to reserve a novel username and finally share it rather than their cellphone quantity.
WhatsApp’s upcoming usernames function will let customers join with out sharing their cellphone numbers.
This permits them to provoke conversations with out sharing cellphone numbers, which have turn into one in all their most private identifiers. Even with the function, one would nonetheless want a cellphone quantity to create and preserve a WhatsApp account.
Story continues beneath this advert
Customers can reserve a novel username forward of WhatsApp’s wider rollout later this 12 months.
Not like comparable options on different platforms, WhatsApp claims that usernames won’t be publicly searchable. There will probably be no public listing or username recommendations. To speak with somebody, one would wish their precise username. WhatsApp stated that customers may also change or disable their username later. As an added layer of privateness, the platform can also be introducing an elective ‘username key’. When it’s activated, each the username and the important thing should be entered earlier than somebody can ship the primary message.
WhatsApp says usernames won’t be publicly searchable and should be entered precisely to provoke contact.
Why is India involved?
Based mostly on MeitY’s letter to WhatsApp, the federal government’s major concern appears to be that usernames may make it simpler for scammers to impersonate notable people or organisations, whereas additionally making it more durable for victims to establish them.
Over the previous few years, India has witnessed a steep rise in phishing, monetary fraud, and digital arrest scams, wherein fraudsters impersonate law enforcement officials, authorities officers, or financial institution workers to strain victims into transferring cash. Authorities information exhibits cyber incidents greater than doubled between 2022 and 2024, whereas tens of millions of cybercrime complaints have been registered by the Nationwide Cyber Crime Reporting Portal, highlighting the rising scale of on-line monetary fraud.
Officers are apprehensive that if fraudsters not want to reveal their cellphone numbers, they may create convincing usernames that resemble outstanding banks, regulators, or authorities businesses and attain out to victims with fewer seen identifiers. The federal government additionally warned {that a} function like this might additional complicate investigations by lowering the variety of instantly seen id data accessible to customers and investigators.
Story continues beneath this advert
Can privateness and security coexist?
WhatsApp argues that the function is designed to enhance privateness with out sacrificing safety. Digital rights specialists say the function may additionally profit girls and different susceptible customers who might not want to share their cellphone numbers when becoming a member of teams or interacting with new contacts.
The platform stated that, at its core, Usernames is a privateness function, not a social media deal with, and that there is no such thing as a listing to browse or recommendations. In the case of impersonation, WhatsApp has stated it reserves usernames for public figures, celebrities, authorities entities, and verified Meta accounts, so solely their reliable homeowners can declare them. It has additionally reserved comparable variations of many outstanding names to cut back impersonation makes an attempt.
Moreover, the platform stated it’s going to restrict the variety of new customers an account can contact, block repeated makes an attempt to guess usernames or username keys, and use automated methods to detect abusive behaviour or potential impersonation.
When customers obtain a primary message from a username, WhatsApp will even show contextual data, corresponding to whether or not the sender is a brand new account, already within the recipient’s contacts, shares widespread teams, or relies overseas, permitting recipients to make a extra knowledgeable determination earlier than responding.
Story continues beneath this advert
Whereas the controversy has largely centered on fraud dangers, privateness advocates say the function may additionally provide tangible advantages for customers who don’t need to disclose their cellphone numbers. “Surely, this can be a welcome function for girls, susceptible customers who would reasonably not reveal their cellular numbers to be contacted when becoming a member of WhatsApp teams and communities. The 850+ million userbase of WhatsApp additionally locations bigger scrutiny on WhatsApp than different messaging platforms,” stated Nidhi Sudhan, co-founder of the Citizen Digital Basis.
Are the federal government’s considerations reliable?
Specialists say the controversy displays a real tradeoff between consumer privateness and platform safety. Whereas the federal government’s apprehensions are technically credible, the dangers will largely rely upon how successfully the platform’s safeguards work in the actual world.
Dr Srinivas Padmanabhuni, CTO of AiEnsured, stated the considerations have “robust technical advantage” as a result of cellphone numbers at the moment act as traceable identifiers. “Cellphone numbers are tied to SIMs, KYC and telecom logs — bodily, traceable anchors that elevate the fee for an attacker. Usernames take away that barrier totally,” he stated. He added that usernames make it simpler for fraudsters to create convincing identities at scale.
In accordance with Padmanabhuni, usernames are “free, infinite and allow industrialised impersonation”, permitting attackers to create 1000’s of misleading accounts utilizing strategies corresponding to leetspeak or lookalike characters to evade detection.
Story continues beneath this advert
Advocate Dr Chinmay Bhosale, co-founder of NYAI, stated the federal government’s considerations have been “not with out advantage”, given the dimensions of identity-based fraud and impersonation that might happen if safeguards weren’t constructed into the function from the outset. “It’s not simply authorities officers being impersonated for scams like digital arrests. This may very nicely lengthen to day-to-day frauds involving strange people as nicely,” he stated.
Bhosale stated sturdy verification measures could be important if the function is rolled out.”Correct safeguards ought to be in place, together with tagging the fitting KYC paperwork to every account, thereby guaranteeing that the id of the account holder might be authenticated,” he added.
He additionally warned that the shortage of authentication may undermine belief in official communications from companies, banks and authorities businesses, whereas creating larger alternatives for fraud and cybercrime.
Privateness good points versus safety dangers
Nonetheless, Garima Saxena, programme supervisor at The Dialogue, stated the dangers usually are not distinctive to WhatsApp and ought to be considered alongside the privateness advantages of lowering phone-number publicity.
Story continues beneath this advert
“Username-based contact methods can provide a privateness profit by permitting customers to attach with out disclosing cellphone numbers. That is vital as a result of phone-number publicity can itself create dangers of harassment, scraping, stalking, spam, and fraud,” she stated.
In the meantime, Tarun Wig, co-founder and CEO of Innefu Labs, stated these privateness good points ought to be considered within the context of how cellphone numbers operate in India. “In India, the cellphone quantity quietly doubles as an id and belief sign for an enormous inhabitants that isn’t deeply tech-literate. So the profit is actual, it simply must be rolled out alongside safeguards that protect that very same belief, not as an alternative of it,” he stated.
Saxena famous that WhatsApp’s implementation differs from platforms corresponding to Telegram, the place usernames are publicly searchable. “WhatsApp has said that usernames will probably be elective, non-searchable, and usable solely the place somebody is aware of the precise username. It would additionally provide an elective username key, that means that an individual might have each the username and key to provoke contact. This reduces discovery, impersonation, and unsolicited contact dangers.” She stated regulators ought to assess whether or not WhatsApp’s safeguards are ample for India’s menace panorama reasonably than deal with usernames as inherently unsafe. Padmanabhuni, nevertheless, believes some vital gaps stay.
“Reserved names block @whatsapp, not each permutation of it. Contact limits decelerate spam however do little in opposition to focused spear-phishing. Contextual warnings depend on consumer judgement, which is weak in opposition to panic-driven fraud like digital arrest scams.”
Story continues beneath this advert
Wig stated lowering phone-number publicity addresses just one side of on-line fraud. “It solely addresses one class of fraud. It does nothing to stop social-engineering assaults, arguably it makes them simpler, since a username provides not one of the implicit verification a cellphone quantity at the moment gives,” he stated.
Saxena stated further protections may additional cut back the dangers. She urged making username keys and stricter first-contact controls the default for public-facing accounts, increasing lookalike detection past celebrities and authorities entities to generally impersonated banks and public companies, and displaying clearer context about first-time senders, corresponding to whether or not an account is new, just lately renamed or based mostly overseas.
“From a coverage perspective, the main focus ought to be on escalation channels, clear impersonation-dispute processes, and time-bound mechanisms to freeze or revoke usernames the place credible hurt is proven,” she stated.
What occurs subsequent?
WhatsApp has stated usernames usually are not but dwell and will probably be rolled out steadily later this 12 months because it continues gathering suggestions. India, which has greater than 500 million WhatsApp customers, stays the platform’s largest market, making the federal government’s place significantly important.
Story continues beneath this advert
The result of the consultations may form not solely WhatsApp’s rollout in India but in addition regulators’ analysis of future privacy-enhancing options. Extra broadly, the dispute displays a rising stress between two competing priorities: defending customers’ privateness by lowering the quantity of non-public data they need to share on-line, and guaranteeing that new applied sciences don’t inadvertently facilitate fraud and impersonation.