\n<\/p>\n
WhatsApp this week started rolling out username reservations<\/a> ahead of the broader launch planned later this year. The feature \u2014 which lets people find and message each other by handle instead of phone number \u2014 is already raising impersonation concerns, drawing scrutiny from security experts and regulators in India, the app\u2019s largest market, with more than 500 million users.<\/p>\n The rollout marks a shift in how people identify one another on WhatsApp. Instead of relying on phone numbers as the primary identifier, users will increasingly interact through platform-managed usernames, a change that Meta says improves privacy but that critics argue could create new opportunities for impersonation.<\/p>\n In early testing, TechCrunch found usernames resembling prominent politicians, celebrities, business figures, and public institutions \u2014 including \u201cindiamodi,\u201d \u201cshahrukh.actor,\u201d \u201cteamamitabh,\u201d \u201cambanijio,\u201d and \u201crbi_verify\u201d \u2014 were still available to reserve. These reference Indian Prime Minister Narendra Modi, Bollywood actors Shah Rukh Khan, and Amitabh Bachchan, billionaire Mukesh Ambani\u2019s telecom company Jio, and the Reserve Bank of India, respectively. Separately, Binance founder Changpeng Zhao said<\/a> on X that he couldn\u2019t reserve \u201ccz_binance,\u201d the handle he already uses on that platform.<\/p>\n Asked about how it protects against impersonation, Meta told TechCrunch it reserves usernames for public figures, government entities, and \u201csome variations\u201d of those names so only the legitimate owner can claim them. The company did not explain, however, how it decides which lookalike usernames get proactively reserved and which don\u2019t.<\/p>\n The concerns have already reached regulators in India, where cyber fraud schemes frequently exploit messaging platforms<\/a> to impersonate police, banks, and government officials.<\/p>\n In a notice sent to WhatsApp on Wednesday and reviewed by TechCrunch, the Ministry of Electronics and Information Technology (MeitY) said the feature could \u201cmaterially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks\u201d by enabling bad actors to contact users without exposing their phone numbers.<\/p>\n The ministry also warned that usernames could facilitate impersonation of \u201cindividuals, public authorities, financial institutions, and government agencies\u201d by allowing usernames closely resembling those of genuine people or organizations. It directed WhatsApp to explain why regulatory action should not be initiated under India\u2019s IT laws and asked the company not to roll out the feature until consultations were completed.<\/p>\n A senior government official separately told TechCrunch that the Indian IT ministry is cognizant of the issue and is engaging with WhatsApp over the feature.<\/p>\n That intervention has drawn its own pushback from New Delhi-based digital rights group Internet Freedom Foundation (IFF), which said<\/a> the notice lacked a clear legal basis and risked giving the executive broad powers to dictate product design. (It\u2019s a dilemma that operators building in regulated markets know well: Rules made case-by-case, by letter, are harder to plan around than rules made in the open.)<\/p>\n \u201cImpersonation and fraud are real risks, but they are met by enforcing the criminal law against those who commit them,\u201d the group said in a statement. \u201cThey are not met by MeitY deciding, in private and by letter, what features Indians may use.\u201d<\/p>\n The debate echoes a similar observation<\/a> the Delhi High Court made in a case involving Telegram, where the court said that using usernames instead of phone numbers could make it easier to conceal user identity and spread illicit content faster. That case wasn\u2019t about WhatsApp, but the parallel has been resurfacing in public discussion as WhatsApp prepares its own launch.<\/p>\n Rachel Tobac, chief executive of SocialProof Security, called usernames a net privacy gain because they reduce the need to share phone numbers, which can expose users to SIM-swap attacks, phishing, and account takeovers. Still, she said, lookalike usernames still create opportunities for impersonation.<\/p>\n \u201cUltimately, usernames are a great idea to avoid leaking your phone number to folks you don\u2019t know, but it\u2019s important to verify identity with the username function too,\u201d Tobac told TechCrunch.<\/p>\n Her advice for most users: Pick a username that isn\u2019t easily guessable, so it\u2019s harder for attackers to find you, message you cold, or harass and spam you.<\/p>\n Even WhatsApp acknowledges usernames won\u2019t be one-size-fits-all. In an FAQ posted<\/a> on X on Wednesday, the company said most users should choose a username unique to WhatsApp. However, it also lets users claim their existing Instagram or Facebook usernames by linking their accounts, saying the option is intended to help creators, businesses, and organizations maintain a consistent identity across Meta\u2019s platforms while reducing impersonation.<\/p>\n The Mozilla Foundation said the introduction of usernames is likely to bring new tradeoffs. \u201cIncreased scams and impersonation from fake handles are potentially a big one,\u201d it told TechCrunch. \u201cChecking a phone number can be a useful verification tool, but these harms are also permitted by the platform\u2019s fundamental design choices.\u201d<\/p>\n Mozilla also flagged a broader interoperability question \u2014 one worth logging if you\u2019re building on top of, or competing with, Meta\u2019s ecosystem. While letting users claim their existing Facebook and Instagram usernames may cut down on impersonation, it also shows how easily Meta can stitch identity together across its own apps, even as users still can\u2019t take that identity, or their contacts, to a rival platform. <\/p>\n For now, WhatsApp says it is taking a gradual approach to the rollout. \u201cWe\u2019re taking our time and listening to feedback so that when it rolls out later this year we get it right,\u201d the company said in its FAQ.<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\nPrivacy, trust, and platform power<\/h2>\n