WhatsApp this week began rolling out username reservations ahead of a broader launch planned later this year, a shift that allows users to find and message each other by handle instead of phone number. The feature is already drawing scrutiny from security experts and regulators in India, the app’s largest market with more than 500 million users, over impersonation concerns.
The rollout marks a fundamental change in how people identify one another on WhatsApp. Instead of relying on phone numbers as the primary identifier, users will increasingly interact through platform-managed usernames. Meta says this improves privacy, but critics argue it creates new opportunities for impersonation.
Also read: Kobo eReader now syncs with StoryGraph, taking on Amazon's Kindle-Goodreads hold
Lookalike usernames and public figures
In early testing, TechCrunch found that usernames resembling prominent politicians, celebrities, business figures, and public institutions were still available to reserve. These included “indiamodi” (referencing Prime Minister Narendra Modi), “shahrukh.actor” (Bollywood star Shah Rukh Khan), “teamamitabh” (Amitabh Bachchan), “ambanijio” (Mukesh Ambani’s telecom company), and “rbi_verify” (Reserve Bank of India). Separately, Binance founder Changpeng Zhao said on X that he could not reserve “cz_binance,” the handle he already uses on that platform.
Asked about how it protects against impersonation, Meta told TechCrunch it reserves usernames for public figures, government entities, and “some variations” of those names so only the legitimate owner can claim them. The company did not explain, however, how it decides which lookalike usernames get proactively reserved and which do not.
Also read: Ian Bogost on ‘The Small Stuff’: Why Reclaiming Ordinary Life Matters More Than Fighting Big Tech
Regulatory intervention in India
The concerns have reached the Ministry of Electronics and Information Technology (MeitY) in India, where cyber fraud schemes frequently exploit messaging platforms to impersonate police, banks, and government officials. In a notice sent to WhatsApp on Wednesday and reviewed by TechCrunch, MeitY said the feature could “materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks” by enabling bad actors to contact users without exposing their phone numbers.
The ministry warned that usernames could allow impersonation of “individuals, public authorities, financial institutions, and government agencies” by allowing usernames closely resembling those of genuine people or organizations. It directed WhatsApp to explain why regulatory action should not be initiated under India’s IT laws and asked the company not to roll out the feature until consultations were completed. A senior government official separately told TechCrunch that the Indian IT ministry is engaging with WhatsApp over the feature.
That intervention has drawn pushback from the New Delhi-based digital rights group Internet Freedom Foundation (IFF), which said the notice lacked a clear legal basis and risked giving the executive broad powers to dictate product design. “Impersonation and fraud are real risks, but they are met by enforcing the criminal law against those who commit them,” the group said in a statement. “They are not met by MeitY deciding, in private and by letter, what features Indians may use.”
The debate echoes a similar observation the Delhi High Court made in a case involving Telegram, where the court said that using usernames instead of phone numbers could make it easier to conceal user identity and spread illicit content faster. That case was not about WhatsApp, but the parallel has resurfaced in public discussion as WhatsApp prepares its own launch.
Privacy, trust, and platform power
Rachel Tobac, chief executive of SocialProof Security, called usernames a net privacy gain because they reduce the need to share phone numbers, which can expose users to SIM-swap attacks, phishing, and account takeovers. Still, she said, lookalike usernames create opportunities for impersonation. “Ultimately, usernames are a great idea to avoid leaking your phone number to folks you don’t know, but it’s important to verify identity with the username function too,” Tobac told TechCrunch. Her advice for most users is to pick a username that is not easily guessable, making it harder for attackers to find and message them cold.
Even WhatsApp acknowledges usernames will not be one-size-fits-all. In an FAQ posted on X on Wednesday, the company said most users should choose a username unique to WhatsApp. However, it also lets users claim their existing Instagram or Facebook usernames by linking their accounts, saying the option is intended to help creators, businesses, and organizations maintain a consistent identity across Meta’s platforms while reducing impersonation.
The Mozilla Foundation said the introduction of usernames is likely to bring new tradeoffs. “Increased scams and impersonation from fake handles are potentially a big one,” it told TechCrunch. “Checking a phone number can be a useful verification tool, but these harms are also permitted by the platform’s fundamental design choices.” Mozilla also flagged a broader interoperability question: while letting users claim their existing Facebook and Instagram usernames may cut down on impersonation, it also shows how easily Meta can stitch identity together across its own apps, even as users still cannot take that identity or their contacts to a rival platform.
For now, WhatsApp says it is taking a gradual approach to the rollout. “We’re taking our time and listening to feedback so that when it rolls out later this year we get it right,” the company said in its FAQ.
Frequently Asked Questions
What is the new WhatsApp username feature?
The feature lets users create a unique handle that others can use to find and message them on WhatsApp, without needing to share their phone number. It is currently being rolled out gradually ahead of a broader launch later this year.
Why are Indian regulators concerned about WhatsApp usernames?
The Ministry of Electronics and Information Technology (MeitY) warned that usernames could be used to impersonate individuals, government agencies, and financial institutions, potentially increasing online fraud, phishing, and digital arrest scams.
How is Meta addressing impersonation risks with usernames?
Meta says it proactively reserves usernames for public figures, government entities, and some variations of those names so only legitimate owners can claim them. However, it has not fully detailed how it decides which usernames to reserve.
What is the privacy benefit of WhatsApp usernames?
Usernames reduce the need to share phone numbers, which can help protect users from SIM-swap attacks, phishing, and account takeovers. Security experts consider this a net privacy gain, though impersonation risks remain.
