Explained | WhatsApp Usernames: A privacy boost or new cyber risk?

CHENNAI: WhatsApp's upcoming username feature, which will allow users to connect without sharing their phone numbers, has come under the Centre's scrutiny over concerns that it could be misused for fraud and impersonation.

While Meta has started rolling out username reservations globally, the company has assured the government that the feature will not be launched in India until consultations are complete.

The government has now received WhatsApp's response to its notice on the proposed feature and is examining the submission. The feature is being positioned as one of WhatsApp's biggest privacy upgrades, but it has also sparked debate over whether it could create new cyber risks.

What are WhatsApp usernames?

WhatsApp usernames are unique identifiers that allow users to communicate without revealing their phone numbers. Instead of sharing a mobile number, users can share a username while keeping their number private.

The feature is optional, and users who do not create a username can continue using WhatsApp with their phone number as they do today.

How will the feature work?

Each username must be unique and begin with the '@' symbol. Users can reserve their preferred username through the latest version of the app ahead of the wider rollout.

WhatsApp says usernames are intended as a privacy feature rather than a social media identity. Unlike platforms such as Instagram and Telegram, there will be no public username directory or search function.

Username key: For first-time conversations, users may need both the username and an additional key, adding another layer of protection against unwanted contact.

How can you reserve your username?

Go to:

Settings > Account > Username

Why is the government concerned?

The Ministry of Electronics and Information Technology (MeitY) has sought a detailed explanation from WhatsApp, expressing concerns that usernames could make impersonation, phishing, online fraud and "digital arrest" scams easier.

The Centre has directed WhatsApp not to roll out the feature in India until consultations are completed and its concerns are addressed.

The notice also asked Meta to explain why action should not be initiated under the IT Act and related rules if the feature is found to increase cybercrime risks. As a significant social media intermediary, WhatsApp is required to comply with due diligence obligations under Indian law.

What cyber risks should users know about?

Cybersecurity experts warn that scammers may create deceptive usernames resembling trusted individuals, brands or organisations to trick users.

Experts advise users not to trust a username alone and to verify the identity of unknown contacts before sharing personal, financial or sensitive information.

Fake usernames combined with AI-generated content could significantly improve the effectiveness of social engineering attacks.

Users should also remain alert to phishing attempts, fake support accounts, fraudulent investment schemes and impersonation scams that may exploit usernames.

What safeguards has WhatsApp promised?

No public search: Usernames will not be publicly searchable, reducing the chances of strangers discovering users through the platform.

Impersonation protection: WhatsApp says it is reserving usernames for public figures, government institutions, celebrities and Meta Verified accounts. Lookalike versions of these usernames will also be restricted.

Abuse controls: The company says it will limit how many new people an account can contact, block repeated attempts to guess a user's username key and deploy systems to detect and remove suspicious activity.

Additional context: When users receive a message from someone they do not know, WhatsApp says it will provide information such as the sender's country, account age and shared groups to help users make informed decisions before responding.

What are the key features of WhatsApp usernames?

Optional and changeable: Users can change or delete their username at any time, subject to availability.

Username key: New contacts may be required to enter a username key before sending a message.

No public directory: People will need to know the exact username to contact a user.

Privacy: Users messaging someone who has not saved their number will see the username instead of the phone number by default.

Phone number still required: A phone number remains mandatory to create and maintain a WhatsApp account.

What about Telegram and Signal?

The IT Ministry's scrutiny is not limited to WhatsApp. After issuing a notice to WhatsApp, the Centre also sent notices to Telegram and Signal, seeking details on how their username-based systems address concerns related to fraud and impersonation.

WhatsApp submitted its response on July 10, followed by Telegram. According to sources, the IT Ministry is examining the replies, though the contents have not been made public.

The review forms part of a broader assessment of username-based communication systems and their potential impact on online safety.

Notably, Telegram and Meta have also faced separate regulatory scrutiny in recent days. The government recently issued a notice to Meta over child sexual abuse material appearing in Instagram advertisements, while Telegram was directed to crack down on the dissemination of pirated films, OTT content and other audio-visual material through its platform.

(With PTI inputs)