WhatsApp is introducing username reservations, allowing users to communicate using unique handles rather than traditional phone numbers. While this shift promises increased convenience, it also enables impersonation—during testing, handles like ‘indiamodi’ and ‘shahrukh.actor’ were available for anyone to claim, and Binance founder CZ could not secure ‘cz_binance’. As the app prepares for a broader release in 2026, experts and regulators are sounding alarms about the potential surge in online fraud.
The rollout of usernames marks a pivotal change in user interaction on the platform. Users searching for familiar names might easily stumble upon handles that closely mimic those of public figures or organizations, leading to confusion or deceit.
During initial testing, TechCrunch reported that usernames mirroring well-known personalities were readily available. For instance, “indiamodi” for Prime Minister Narendra Modi, “shahrukh.actor” for Bollywood star Shah Rukh Khan, “teamamitabh” for Amitabh Bachchan, “ambanijio” for billionaire Mukesh Ambani’s telecom company Jio, and “rbi_verify” for the Reserve Bank of India. These usernames, which could easily be mistaken for authentic accounts, exacerbate the risk of impersonation. Notably, Binance’s founder Changpeng Zhao expressed his frustration on X, revealing he was unable to secure his handle “cz_binance,” which he already uses on other platforms.
In response to security concerns, Meta announced it would reserve usernames for verified public figures and government organizations.
Regulatory bodies in India, which boasts WhatsApp’s largest user base with over 500 million users, are particularly concerned. The Ministry of Electronics and Information Technology (MeitY) issued a notice warning that the new username feature could heighten online fraud, phishing attempts, and impersonation. The ministry specifically highlighted how easily malicious actors could reach users without revealing their actual phone numbers.
In an official communication, MeitY instructed WhatsApp to explain why it should not face regulatory repercussions under India’s IT regulations. They expressed concerns that usernames could facilitate the impersonation of legitimate individuals and organizations, thus complicating online safety. The ministry urged the company to delay the rollout until these discussions were resolved.
Responses from digital rights advocates have varied. The Internet Freedom Foundation (IFF) criticized the ministry’s notice for lacking a strong legal foundation, arguing that it could grant excessive power to officials in determining product designs. They emphasized that impersonation and fraud should be addressed using existing legal frameworks instead of restricting user features.
This situation also underscores broader issues related to user privacy and trust in digital platforms. Rachel Tobac, CEO of SocialProof Security, acknowledged the privacy benefit—usernames reduce phone number exposure—but concluded the impersonation risk outweighs this for most users. Tobac advised users to select usernames that are difficult to guess to minimize their chances of becoming targets for malicious actors.
WhatsApp acknowledges that the introduction of usernames may not be a one-size-fits-all solution. In a recent FAQ posted on X, the company suggested that most users create unique usernames specifically for WhatsApp. It also allows users to link their existing Instagram or Facebook usernames to maintain a consistent identity across Meta’s platforms. While this approach seeks to mitigate impersonation risks, it raises new questions about how users will manage their identities across different platforms.
The Mozilla Foundation pointed out that although usernames might offer certain benefits, they also introduce fresh risks, especially regarding scams and impersonation. The organization noted that the ability to verify users via phone numbers—an established security measure—will be compromised with the introduction of usernames. They emphasized that these potential risks stem from foundational design choices made by the platform.
Given MeitY’s warning and the availability of impersonation handles during testing, users should avoid adopting usernames until Meta clarifies its verification process for public figures and organizations.
