WhatsApp usernames already raising impersonation red flags
WhatsApp has started rolling out username reservations, allowing users to be found by handle instead of phone number, but impersonation concerns have drawn scrutiny from regulators in India, the app's largest market.
WhatsApp this week began reserving usernames ahead of a broader rollout later this year. The feature lets users find and message each other using a handle rather than a phone number, a shift Meta says improves privacy. However, security experts and regulators in India — WhatsApp's largest market with over 500 million users — have raised impersonation concerns.
During early testing, TechCrunch found that usernames resembling prominent figures and institutions, such as “indiamodi,” “shahrukh.actor,” and “rbi_verify,” were still available. Binance founder Changpeng Zhao said he could not reserve “cz_binance.” Meta stated it reserves usernames for public figures, government entities, and some variations, but did not explain how it decides which lookalikes are blocked.
India's Ministry of Electronics and Information Technology (MeitY) sent WhatsApp a notice warning that the feature could “materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks.” The ministry directed WhatsApp to explain why regulatory action should not be taken and asked the company to pause the rollout until consultations are complete.
The Internet Freedom Foundation criticized the notice, saying it lacked a clear legal basis and risked giving the executive broad powers over product design. Rachel Tobac of SocialProof Security noted that usernames are a privacy gain but still pose impersonation risks; she advised choosing a non-guessable handle. The Mozilla Foundation highlighted potential tradeoffs, including increased scams and interoperability issues across Meta's platforms.
WhatsApp says it is taking a gradual approach and listening to feedback to ensure a proper rollout later this year.
