WhatsApp Usernames Spark Serious Impersonation Fears Before Full Launch

WhatsApp's New Username Feature Is Already Under Fire

Meta has begun rolling out username reservations on WhatsApp ahead of a broader launch expected later this year. The feature allows users to find and contact one another through custom handles rather than phone numbers — a change Meta frames as a privacy improvement. But the rollout has quickly attracted sharp criticism from cybersecurity professionals, digital rights advocates, and government regulators, particularly in India, where WhatsApp has over 500 million active users.

How the Feature Works — and Why It's Causing Concern

The shift from phone numbers to platform-assigned usernames fundamentally changes how people identify each other on WhatsApp. Meta argues the change reduces personal data exposure, but critics warn it simultaneously opens a dangerous new door for bad actors looking to impersonate well-known individuals and trusted institutions.

Early testing by TechCrunch revealed that usernames closely resembling those of prominent public figures and organizations were still available to claim. These included handles referencing Indian Prime Minister Narendra Modi, Bollywood icons Shah Rukh Khan and Amitabh Bachchan, Mukesh Ambani's telecom brand Jio, and even the Reserve Bank of India. Separately, Binance co-founder Changpeng Zhao publicly noted he was unable to reserve his own widely recognized handle, "cz_binance."

Meta's Response Falls Short for Many Critics

When pressed on how it plans to prevent misuse, Meta stated that it proactively reserves usernames for public figures, government bodies, and certain name variations so that only legitimate owners can claim them. However, the company stopped short of explaining exactly how it determines which lookalike usernames qualify for protection — and which ones slip through the cracks.

That vagueness has done little to reassure skeptics, especially in markets already dealing with rampant digital fraud.

Indian Regulators Issue a Formal Warning

The concerns have escalated quickly in India. The country's Ministry of Electronics and Information Technology (MeitY) sent WhatsApp a formal notice warning that the username feature could significantly increase incidents of online fraud, phishing attacks, digital arrest scams, and impersonation. The ministry specifically flagged the risk of bad actors creating handles that closely mimic those of real individuals, financial institutions, and government agencies.

Regulators directed WhatsApp to explain why enforcement action should not be taken under India's existing IT laws and urged the platform to pause the rollout until proper consultations could take place. A senior government official confirmed to TechCrunch that the IT ministry is actively engaging with WhatsApp on the matter.

Digital Rights Groups Push Back on Regulatory Approach

Not everyone agrees with the government's intervention, however. The Internet Freedom Foundation (IFF), a New Delhi-based digital rights organization, challenged the legal basis of MeitY's notice. The group argued that addressing fraud through private correspondence between regulators and tech platforms — rather than through transparent, codified law — risks giving authorities unchecked power over product decisions.

"Impersonation and fraud are real risks, but they are met by enforcing the criminal law against those who commit them," the IFF said in a public statement. "They are not met by MeitY deciding, in private and by letter, what features Indians may use."

The debate also echoes a notable ruling by the Delhi High Court in a case involving Telegram, where the court observed that username-based communication could make it easier to conceal user identity and distribute harmful content. While that case did not involve WhatsApp, it has become a reference point in the current discussion.

Security Experts Weigh the Tradeoffs

Cybersecurity professionals have offered a more nuanced view. Rachel Tobac, CEO of SocialProof Security, acknowledged that usernames represent a genuine privacy gain since they reduce the need to share phone numbers — which can expose users to SIM-swap attacks, account takeovers, and targeted phishing campaigns. At the same time, she cautioned that lookalike handles still pose a meaningful impersonation risk.

"Usernames are a great idea to avoid leaking your phone number to people you don't know, but verifying identity through the username function still matters," Tobac told TechCrunch. Her advice to everyday users: choose a username that isn't easily guessable to reduce your exposure to unsolicited messages, spam, and harassment.

Cross-Platform Identity and Broader Implications

WhatsApp has also introduced an option for users to claim their existing Facebook or Instagram usernames by linking accounts — a move intended to help creators, businesses, and organizations maintain consistent branding across Meta's ecosystem while reducing impersonation risk.

However, the Mozilla Foundation pointed out that this integration highlights a deeper issue. While it may reduce some impersonation, it also demonstrates how readily Meta can consolidate identity across its platforms — even as users remain unable to transfer that identity, or their contact lists, to competing services.

"Increased scams and impersonation from fake handles are potentially a big concern," Mozilla told TechCrunch. "Checking a phone number can be a useful verification tool, but these harms are also shaped by the platform's fundamental design choices."

WhatsApp Promises a Careful Rollout

For its part, WhatsApp insists it is moving deliberately. "We're taking our time and listening to feedback so that when it rolls out later this year we get it right," the company said in a public FAQ posted on X.

Whether that measured approach will be enough to satisfy regulators, security experts, and a user base of billions remains an open question — one that will likely define how the feature is ultimately received across the globe.