This week, WhatsApp began to implement a feature allowing users to reserve usernames ahead of its full launch later this year. This development, which permits users to connect via handles rather than phone numbers, has already sparked concerns about potential impersonation issues, drawing attention from security specialists and regulators in India, WhatsApp’s largest market, boasting over 500 million users.
This new feature represents a significant change in how users identify each other on WhatsApp. Moving away from phone numbers as the main identification method, users will soon be able to interact through managed usernames, a shift that Meta claims enhances privacy. However, critics warn that this change might also open doors for impersonation attempts.
Initial tests revealed that usernames close to those of well-known politicians, celebrities, business leaders, and public institutions—including names like “indiamodi,” “shahrukh.actor,” “teamamitabh,” “ambanijio,” and “rbi_verify”—were still available for reservation. These names correspond to Indian Prime Minister Narendra Modi, film stars Shah Rukh Khan, Amitabh Bachchan, Mukesh Ambani’s telecom company Jio, and the Reserve Bank of India. In contrast, Binance’s CEO Changpeng Zhao reported that he was unable to reserve “cz_binance,” a handle he currently uses on another platform.
In response to questions about impersonation protection, Meta stated that it reserves usernames for public figures, governmental bodies, and select variations of these names to ensure that only authentic owners can claim them. The company did not clarify the criteria for determining which similar usernames are reserved proactively.
Regulatory concerns in India have arisen, as cyber fraud schemes often leverage messaging applications to impersonate authorities, financial institutions, and government representatives.
In a recent notice to WhatsApp, the Ministry of Electronics and Information Technology (MeitY) warned that this new feature could significantly increase online fraud, phishing, and impersonation attacks by allowing malicious users to reach out to others without revealing their phone numbers.
Furthermore, the ministry cautioned that usernames could facilitate the impersonation of various parties including individuals, public agencies, and financial establishments, by allowing names that closely resemble legitimate entities. The ministry instructed WhatsApp to justify why regulatory measures shouldn’t be taken under India’s IT laws and requested the company to suspend the feature rollout until discussions had concluded.
A senior official within the Indian government noted that they are aware of the concerns and are in communication with WhatsApp regarding this feature.
This intervention has faced criticism from the Internet Freedom Foundation (IFF), a digital rights organization based in New Delhi. They argue that the notice lacked a solid legal foundation and could grant the government excessive influence over product design. The group emphasized that while impersonation and fraud are genuine threats, the solution lies in the enforcement of criminal laws against offenders, not in restricting user features through private decision-making by MeitY.
Concerns about anonymity and identity concealment through usernames echo similar critiques voiced by the Delhi High Court in a Telegram case, illustrating the broader implications of switching from phone numbers to usernames—issues that are being revisited as WhatsApp gears up for its rollout.
Privacy, Trust, and Platform Influence
Rachel Tobac, CEO of SocialProof Security, views the move to usernames as a privacy improvement since it diminishes the necessity of sharing phone numbers, which can lead to SIM-swap attacks, phishing, and account compromises. Nonetheless, she acknowledged that lookalike usernames could still pose impersonation risks.
“In essence, usernames can enhance privacy by preventing the sharing of phone numbers with unknown parties, but it’s crucial to verify identities through this username mechanism as well,” Tobac said.
She advised users to choose unique usernames that are difficult to guess, which would help mitigate the risks of unsolicited contact or harassment.
WhatsApp itself recognizes that usernames won’t suit everyone. An FAQ released recently stated that users are encouraged to select unique usernames for the platform. However, they also allow users to link their existing Instagram or Facebook usernames to enhance consistency for creators, businesses, and organizations while aiming to lower impersonation risks.
The Mozilla Foundation noted that introducing usernames might entail new challenges, highlighting the potential for increased scams and impersonation through fake handles. They pointed out that while verifying a phone number can serve as an effective authentication method, the design framework of the platform might also facilitate these risks.
Moreover, Mozilla raised broader questions about interoperability: as users claim their existing Meta usernames, it illustrates Meta’s capability to integrate identities across its platforms. However, users remain unable to transfer their identities or contacts to competing services.
Currently, WhatsApp emphasizes a careful approach to the rollout. “We are taking time to gather feedback to ensure the feature is implemented correctly when it is fully launched later this year,” the company stated in its FAQ.
