Key Takeaways
- WhatsApp’s upcoming username feature allows users to connect without sharing phone numbers, positioning it as a major privacy enhancement.
- The Indian government has warned that the feature could facilitate cybercrime—phishing, impersonation, digital arrest scams—and has demanded a detailed explanation within three days, threatening regulatory action under IT rules.
- Meta has defended the rollout, emphasizing that a phone number remains required, and has outlined multiple safeguards: limits on new contacts, anti‑guessing mechanisms, and systems to detect impersonation patterns.
- The username rollout is not yet live; Meta plans a slow, phased release later this year while addressing regulatory concerns.
- India’s surge in cyber‑enabled financial crime—more than doubling to ~2.3 million cases in 2024—has shifted policymakers’ focus toward security, prompting heightened scrutiny of platforms with massive user bases like WhatsApp.
- Experts note that with over half a billion Indian users, any feature that eases impersonation (e.g., look‑alike usernames) could accelerate misinformation and fraud, though Meta intends to reserve high‑profile names and block similar derivatives to curb abuse.
- The scrutiny follows a recent temporary ban on Telegram during a national exam to curb leaked‑paper fraud, illustrating India’s growing willingness to hold digital platforms accountable for harm while balancing innovation and privacy concerns.
WhatsApp Introduces Username Feature as a Privacy Tool
On Monday, WhatsApp unveiled a new username functionality that it billed as a “major privacy feature.” The service lets users create a handle akin to those on other social platforms, enabling them to message others without revealing their personal phone numbers. Meta positioned the change as a way to give users more control over their identity while preserving the core requirement that a phone number must still be linked to the account for verification and recovery purposes. The announcement highlighted the potential benefits for people who wish to stay connected with acquaintances, businesses, or communities without exposing their primary contact details.
Indian Government Raises Cybercrime Concerns
Just days after the feature’s announcement, the Indian government voiced strong reservations. In a statement reported by the Indian news agency ANI, officials cautioned that the username rollout “may materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks.” They argued that bad actors could more easily solicit and message victims by adopting plausible usernames, thereby lowering the barrier for social engineering attacks. Consequently, the Ministry of Electronics and Information Technology directed WhatsApp to pause the rollout and submit a detailed explanation within three days, warning that failure to comply could trigger action under the country’s Information Technology (IT) regulations.
Meta’s Defensive Response and Built‑In Safeguards
Meta responded swiftly, defending the feature’s design and stressing that user safety remains a priority. A spokesperson told CNBC that, despite the introduction of usernames, “users still require a phone number to use WhatsApp,” and the company has built “multiple layers of defense against scames into usernames.” Among the safeguards outlined are: limiting how many new contacts an account can reach out to, implementing mechanisms to block repeated username‑guessing attempts, and deploying detection systems that identify activity patterns typical of impersonation or abuse. Meta also clarified that the username feature is not yet live; it will be rolled out “slowly later this year” to allow for monitoring and adjustments based on early‑stage feedback and regulatory input.
Rising Cybercrime Landscape in India
The government’s apprehension is set against a backdrop of exploding cyber‑enabled financial crime in the country. According to data cited by Meta’s own Adversarial Threat report from March, online scam syndicates target Indian users more frequently than any nation besides the United States. Official statistics reveal that cybercrime incidents more than doubled from roughly 1 million cases in 2022 to nearly 2.3 million in 2024. With more than half a billion WhatsApp users residing in India, the platform’s sheer scale makes it an attractive vector for malicious actors, prompting authorities to scrutinize any new functionality that could exacerbate the threat landscape.
Expert Perspectives on Security vs. Privacy Trade‑Offs
Reema Bhattacharya, head of Asia research at Verisk Maplecroft, observed to CNBC that while user privacy remains a factor in policy debates, the “sharp rise in cyber‑enabled financial crime has undoubtedly shifted the center of gravity towards security.” She noted that governments increasingly expect digital platforms to share responsibility for mitigating harm, yet cautioned that drawing the line between legitimate regulation and measures that could stifle innovation or erode user privacy remains challenging. Neil Shah, vice president of research at Counterpoint Research, echoed these concerns, warning that WhatsApp’s extensive reach combined with usernames could accelerate the spread of misinformation and enable scammers to impersonate individuals using familiar names and profile photos.
Measures to Curb Impersonation and Abuse
To address impersonation risks, Meta told CNBC that it will reserve the highest‑profile usernames—those likely to belong to celebrities, public figures, or well‑known brands—so that only their legitimate owners can claim them. Additionally, the platform will withhold look‑alike derivatives of known names, making it harder for attackers to register subtle variations that could deceive users. These steps aim to preserve the integrity of the username space while still offering everyday users the privacy benefits of not sharing their phone numbers.
Context of Recent Platform Scrutiny in India
The scrutiny of WhatsApp’s username feature follows a recent episode in which India temporarily banned Telegram during a crucial national examination to prevent exam‑paper fraud. Authorities alleged that Telegram hosted channels claiming to have leaked test papers and extorted money from candidates and their families for access. Telegram countered that the ban punished 150 million ordinary Indian users rather than the perpetrators. This incident illustrates India’s growing willingness to impose swift restrictions on platforms perceived to facilitate harm, even as it seeks to balance such actions with the preservation of open communication and innovation.
Implications for Future Regulation and Platform Strategy
The ongoing dialogue between WhatsApp (Meta) and Indian regulators underscores a broader trend: as digital platforms embed more privacy‑centric features, governments are scrutinizing whether those innovations inadvertently amplify security risks. For Meta, navigating this terrain will require transparent communication, robust safety mechanisms, and a willingness to adapt rollout timelines in response to regulator feedback. For policymakers, the challenge lies in crafting rules that protect users from cybercrime without undermining the legitimate privacy advantages that features like usernames can provide. The outcome of this engagement may set a precedent for how other social‑media and messaging apps approach similar privacy‑enhancing functionalities in one of the world’s largest digital markets.