- Published on
WhatsApp usernames are already raising impersonation red flags
- Authors
- Name
- DeepHorus
WhatsApp this week began rolling out username reservations ahead of a broader launch planned later this year, but the feature is already raising impersonation concerns. The update allows users to find and message each other by handle instead of phone number, a shift that Meta says improves privacy. However, security experts and regulators in India, WhatsApp’s largest market with over 500 million users, are warning that the change could enable new forms of fraud and identity theft.
The move represents a fundamental change in how people identify one another on WhatsApp. Traditionally, the platform used phone numbers as primary identifiers, but usernames will now allow users to interact without exposing their numbers. Meta argues this enhances privacy by reducing the need to share personal contact information, yet critics contend that platform-managed usernames create fresh opportunities for impersonation.
In early testing, TechCrunch found usernames resembling prominent figures and institutions were still available for reservation. These included “indiamodi,” “shahrukh.actor,” “teamamitabh,” “ambanijio,” and “rbi_verify,” referencing Indian Prime Minister Narendra Modi, Bollywood actors Shah Rukh Khan and Amitabh Bachchan, billionaire Mukesh Ambani’s telecom company Jio, and the Reserve Bank of India. Separately, Binance founder Changpeng Zhao reported on X that he could not reserve “cz_binance,” the handle he uses on other platforms.
Meta told TechCrunch it proactively reserves usernames for public figures, government entities, and “some variations” of those names to ensure only legitimate owners can claim them. However, the company did not explain how it determines which lookalike usernames get reserved. This lack of clarity has fueled concerns that bad actors could easily register usernames mimicking public officials or banks, especially in India where cyber fraud frequently exploits messaging platforms to impersonate authorities.
India’s Ministry of Electronics and Information Technology (MeitY) has already intervened. In a notice reviewed by TechCrunch, the ministry warned that the feature could “materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks” by enabling malicious actors to contact users without exposing their phone numbers. It directed WhatsApp to justify why regulatory action should not be taken under India’s IT laws and asked the company to pause the rollout until consultations are completed.
The notice has drawn pushback from New Delhi-based digital rights group Internet Freedom Foundation (IFF), which argued it lacked a clear legal basis and risked giving the executive broad powers to dictate product design. “Impersonation and fraud are real risks,” the group said, “but they are met by enforcing criminal law, not by MeitY deciding in private what features Indians may use.” This tension echoes a Delhi High Court observation in a Telegram case, where usernames were seen as potentially facilitating illicit content spread.
Privacy expert Rachel Tobac, CEO of SocialProof Security, called usernames a net privacy gain because they reduce reliance on phone numbers, which can expose users to SIM-swap attacks and phishing. She emphasized that proper safeguards are essential. Looking ahead, WhatsApp faces a delicate balancing act: rolling out the feature as planned while addressing regulatory demands and preventing impersonation. The outcome will likely shape how other messaging platforms approach similar username systems in the future.
