India witnessed an unexpected controversy after WhatsApp announced plans to roll out a username feature later this year, allowing users to communicate without sharing their phone numbers. However, the popular messaging platform soon came under the scrutiny of the Government of India as cybersecurity experts warned that the feature could be misused by fraudsters.
Why is WhatsApp introducing a username feature?
The username feature is intended to let users connect without revealing their phone numbers, offering an additional layer of privacy and protection.
According to WhatsApp, the feature is optional and aims to make interactions with new contacts and participation in group chats more secure by reducing the need to share personal contact details.
The company says the feature will be introduced gradually later this year, with multiple safeguards built into the system.
Why are experts and users concerned?
The proposed feature has raised concerns among cybersecurity experts, startup founders and users who fear it could lead to impersonation, spoofing and financial fraud through lookalike usernames.
Some public figures, including MobiKwik Co-founder and CEO Bipin Preet Singh and former Delhi Deputy Chief Minister Manish Sisodia, have said that close variations of their names appear to have already been reserved, fuelling concerns about possible misuse once the feature becomes widely available.
Industry experts have cautioned that shifting trust from a visible phone number to a platform-managed identity could reduce accountability and create new opportunities for online scams.
Government's notice to WhatsApp
On Wednesday, the Centre issued a notice to Meta, stating that WhatsApp's proposed username feature could "materially increase" incidents of online fraud, phishing, digital arrest scams and impersonation attacks by enabling bad actors to contact victims using misleading usernames.
The government has asked Meta to explain why action should not be initiated under the Information Technology Act and the relevant rules, sought detailed documents within three days, and directed the company to pause the rollout until consultations on the issue are completed "to the satisfaction of the Government."
What does WhatsApp say?
With the government's three-day deadline now in effect, attention is on how Meta responds to the concerns raised by Indian authorities.
In a statement issued on Wednesday, a WhatsApp spokesperson maintained that the feature is not yet live and will be rolled out gradually later this year with multiple safeguards.
WhatsApp says usernames are optional, cannot be searched by strangers, and that users can enable an additional "username key", requiring both the username and the key before someone can initiate contact.
In a set of FAQs released on Thursday, WhatsApp reiterated that it has reserved usernames of public figures, celebrities, government entities and Meta-verified accounts, along with lookalike variations, so they can only be claimed by their legitimate owners.
The company also dismissed as "false" claims that popular or well-known usernames are being reserved by other users.
According to WhatsApp, users who link their Instagram or Facebook accounts can choose matching usernames to establish ownership before unlinking those accounts later if they wish.
The platform also said it will display contextual warnings for first-time messages, including whether the sender is using a new account, shares mutual groups or is messaging from another country.
It also plans to limit outreach by newly created accounts, block repeated attempts to guess username keys, and monitor user reports and blocks to detect impersonation and scam patterns.
What happens next?
The government is awaiting Meta's response before deciding its next course of action.
Officials have indicated that unless Meta's response is found satisfactory and the company can adequately address concerns over fraud and impersonation, WhatsApp will not be allowed to roll out the feature in India.
While WhatsApp maintains that the username feature enhances user privacy without compromising safety, cybersecurity experts believe its success will ultimately depend on how effectively the platform verifies identities, detects impersonation attempts, and protects ordinary users and small businesses—not just high-profile accounts—from abuse.
Meanwhile, the Internet Freedom Foundation (IFF) has questioned the legal basis of the Centre's notice.
"It is an attempt by the executive to decide what a company may build and ship, which no statute permits," the digital rights advocacy group said.
In a social media post, the IFF further stated: "MeitY does not name any provision that lets it approve a product feature before release or order one withdrawn, because there is none, and the provisions it does cite do not supply that power."
