WhatsApp's Shift to Usernames Sparks Impersonation Fears

The introduction of usernames on WhatsApp has raised concerns over impersonation, with security experts and regulators in India warning of potential online fraud and phishing attacks.

The rollout of usernames marks a shift in how people identify one another on WhatsApp, with users increasingly interacting through platform-managed usernames instead of phone numbers. However, this change has sparked concerns over impersonation, with critics arguing that it could create new opportunities for scammers to target users.

"Impersonation and fraud are real risks, but they are met by enforcing the criminal law against those who commit them," said the Internet Freedom Foundation (IFF) in a statement. "They are not met by MeitY deciding, in private and by letter, what features Indians may use."

Concerns Over Impersonation

• Usernames resembling prominent politicians, celebrities, and public institutions were found to be available for reservation, raising concerns over impersonation.
• The Indian government has warned that the feature could "materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks" by enabling bad actors to contact users without exposing their phone numbers.
• Security experts have advised users to pick a username that isn't easily guessable to avoid being targeted by attackers.

Regulatory Scrutiny

The Indian Ministry of Electronics and Information Technology (MeitY) has sent a notice to WhatsApp, warning that the feature could facilitate impersonation of individuals, public authorities, financial institutions, and government agencies. The ministry has directed WhatsApp to explain why regulatory action should not be initiated under India's IT laws and has asked the company not to roll out the feature until consultations are completed.

Expert Insights

• Rachel Tobac, chief executive of SocialProof Security, called usernames a net privacy gain because they reduce the need to share phone numbers, which can expose users to SIM-swap attacks, phishing, and account takeovers.
• The Mozilla Foundation said the introduction of usernames is likely to bring new tradeoffs, including increased scams and impersonation from fake handles.

WhatsApp's Response

WhatsApp has said it is taking a gradual approach to the rollout and is listening to feedback to ensure that the feature is implemented correctly. The company has also advised users to choose a username unique to WhatsApp and to verify identity with the username function to avoid impersonation.