Why India has asked WhatsApp to halt its username feature rollout

Though the company is billing the feature to make WhatsApp conversations more private as people would need to know the exact username of a person while contacting them if they do not already have their phone number, some are concerned that bad actors could misrepresent their identities by pretending to be someone they are not. Messaging services like Telegram and Signal already have their own versions of such a feature.

It is worth noting that WhatsApp had earlier said it would roll out the feature in the coming months, and clarified – in response to the government’s notice – that it had built safeguards around the username feature.

Why the government is concerned by WhatsApp’s username feature

In its notice, the government is understood to have told WhatsApp that the feature may materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks, by enabling bad actors to solicit and message unsuspecting users. The government has also flagged that the feature may facilitate impersonation of individuals, public authorities, financial institutions, and government agencies, by permitting the adoption of usernames closely resembling those of genuine people and institutions.

Senior government officials said the Union Ministry of Home Affairs raised concerns with the Ministry of Electronics and IT. They said the government would undertake a risk assessment of the new feature, and see if it falls foul of the current legal architecture.

“As we understand right now, there is a possibility that bad actors may claim usernames, or close-enough variations related to prominent personalities, institutions, and organisations, and message other users while pretending to be someone they are not. For those who may not be technologically aware to make out the difference, it could be a huge challenge. We have already seen bad actors carry out impersonation-linked scams such as digital arrests through WhatsApp, and this feature could further help them,” a senior government official said, requesting anonymity.

“During our internal assessment and subsequent questioning of WhatsApp, if we do not think there are enough guardrails to protect against impersonation, the government may also look into whether the feature’s rollout should be stopped altogether,” a second official said.

Some in the Indian tech community had also raised impersonation-related concerns on the username feature.

Paytm founder and CEO Vijay Shekhar Sharma warned that look-alike usernames could become a major vector for impersonation and scams if not properly protected. “Soon you will have verified username on WhatsApp, and then unverified similar-sounding usernames,” he said in a post on social media platform X.

Mobikwik’s CEO Bipin Preet Singh said on X, “Not a good idea at all. Will lead to proliferation of fraud and impersonation. For example, I checked, most variations of my name already taken. Wonder what can it be used for”.

WhatsApp’s defence

A WhatsApp spokesperson said that to protect against impersonation, the company has held high-profile names of public figures, government entities and celebrities.

“We’ve announced the option for people to reserve their preferred username on WhatsApp. The ability to use a username is not yet live and will roll out slowly later this year. To protect against impersonation, we’ve held the highest-profile names — think public figures, government entities, celebrities, verified Meta accounts — so they can only ever be claimed by their legitimate owners and lookalike derivatives of known names are held as well,” the spokesperson said.

“Users still require a phone number to use WhatsApp and we’ve built multiple layers of defense against scams into usernames: Other users need to know the exact username to message you, we will limit how many new people an account can contact, block repeated attempts to guess someone’s username key, and have systems to detect and remove activity showing common impersonation and abuse patterns,” they added.

In an earlier blog post announcing the feature, WhatsApp said, “Usernames are our latest step to make WhatsApp even more private. There’s no directory to browse and no suggestions – people will need to know your exact username to contact you for the first time”.

As an added safety feature and to allow users to control who can reach them on WhatsApp with their username, the platform has also built an optional username key that others will need to know to message a user.

“When you message someone for the first time who doesn’t have you saved in their contacts, we might share whether your phone number is registered in a country different from theirs to help them know who they’re connecting with so they can stay safe and avoid unwanted contact,” WhatsApp said.

The feature has not been yet rolled out, and WhatsApp is currently allowing users to “reserve” a username for themselves to avoid overlaps with other users. For creators, small businesses, and organisations that may want to maintain a consistent presence online, WhatsApp will allow an option to claim their existing Instagram or Facebook username on WhatsApp.

The company said it takes impersonation-related abuse “seriously,” and will take action against users who may pretend to be someone else.

“WhatsApp takes impersonation and abuse seriously. If you think someone is pretending to be you or someone else on WhatsApp in order to scam other WhatsApp users, or attempting to buy, sell, or trade WhatsApp usernames, you should report the user and any suspicious messages so we can review and take action to protect our users,” WhatsApp said in an update on its help centre, adding that it will remove usernames or ban accounts altogether that it believes violate its terms of service.

After review, the company may remove usernames or ban accounts that it believes are in violation of its terms of service.