New Delhi: The Indian government has served a notice to Meta, seeking a detailed explanation on the WhatsApp username feature within three days, ThePrint has learnt. It has also directed Meta not to roll the feature out until the consultations are over.
In the notice sent on Wednesday addressed to WhatsApp’s Chief Compliance Officer for India operations, the Ministry of Electronics and Information Technology (MeitY) said it had taken note of the phased global rollout, announced on 29 June, that will let users reserve unique usernames and eventually message one another without revealing their mobile numbers. The ministry flagged that once enabled, “the recipient’s phone number will no longer be visible to a first-time contact,” with only an optional “username key” as an added control.
Its central worry is that the feature “may materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks, by enabling bad actors to solicit and message victims,” and could aid “impersonation and identity spoofing,” including of “public authorities, financial institutions, and government agencies,” through handles that closely resemble those of genuine persons or institutions.
Noting that WhatsApp is a “significant social media intermediary” under the IT Act and the IT Rules, 2021, the ministry invoked Section 79 read with the due-diligence framework, Rules 3 and 4, including the first-originator traceability requirement, and Sections 66C and 66D, which penalise identity theft and cheating by personation.
WhatsApp has been directed “to furnish a detailed explanation, supported by relevant documents… within three days,” and told “not to roll out this feature until the consultation on this point is achieved to the satisfaction of the Government”. The notice adds that it issues “with the approval of the Competent Authority,” and without prejudice to any further action by the government or law enforcement agencies.
“The new WhatsApp username feature is a matter of concern, as it has implications for digital security and could facilitate online fraud. We are examining it, and if required, we may even send a notice to the company,” a senior government official had told ThePrint earlier in the day.
WhatsApp this week began letting users reserve a username, ahead of a full rollout expected later this year. Once the feature goes live, a WhatsApp user will be able to message another on the platform without sharing their phone number.
The Meta-owned platform in a blog post announcing the feature Monday said the idea is to let people talk without handing over personal details. “Sometimes you just want to chat without handing over your digits”.
The pitch lands differently in India, where a phone number is linked to a bank account, a UPI ID, an Aadhaar and much else, and cannot be pulled back once shared. Women have long complained that one WhatsApp chat with a stranger turns into unwanted calls and texts that a block does not stop. But the timing is awkward.
The feature comes barely 10 days after the Centre temporarily blocked Telegram, over the same questions a username now raises: how anonymous a messaging app should let people be, and how easily police can trace users when something goes wrong.
Lawyers, industry experts and law enforcement agencies are reading the proposed feature in very different ways.
How it works
For now, users can only reserve a username. The feature will go live gradually, region by region. To reserve a username, one has to go to Settings, tap on profile, and select ‘Create Username’, or ‘Reserve Username’ where the rollout is still underway. A username must be 3-35 characters and can use lowercase letters, numbers, underscores and periods.
Businesses and creators can claim the same handle they use on Instagram or Facebook.
WhatsApp says the system is built to stay private. “There’s no directory to browse and no suggestions,” it said in the blog post.
It even gave the example of a parent group chat: “You want to join the parent chat for the soccer team but you’re not ready to give your phone number to people you’ve never met.”
Adding, “People will need to know your exact username to contact you for the first time.”
There is also an optional “username key”, a kind of PIN. “We’ve built an optional username key that others will need to know to message you,” the company said.
Existing contacts who have your number saved will keep seeing it. As WhatsApp put it, once the feature launches, “when you message a person or business for the first time they will no longer see your phone number, if you enabled your username”.
If a user deletes or changes a username, it can be reclaimed within 14 days before it becomes available to others.
WhatsApp is late to this
The idea is not new, Dubai-headquartered messaging app Telegram has had usernames since its early days, letting users set a public @handle, share it instead of a number, and be reached by strangers who know it.
That openness is now central to the government’s concerns about the app.
US-based Signal added usernames in 2024 and made phone numbers private by default. A user’s number is not visible to those they chat with unless it is already saved in their contacts, and handles can be changed or deleted at will.
There is one important difference. Signal has said that once a username is changed or deleted, it can no longer easily link that handle back to an account. WhatsApp is expected to keep phone numbers as the underlying account identifier, with usernames sitting on top. That is the distinction Indian investigators are watching.
The Telegram shadow
On 16 June, the government temporarily blocked Telegram, ordering Google and Apple to remove it from their app stores. The trigger was the NEET-UG medical entrance exam, cancelled in May after investigators found leaked questions matching a guess paper circulated through Telegram channels in Rajasthan. More than two million students had to appear for the exam again. Investigators said cheating networks exploited Telegram’s message-editing tool, posting blank messages before the exam, editing in the real questions afterwards, and passing off screenshots as proof of an advance leak.
A Ministry of Home Affairs (MHA) report filed in the Delhi High Court described Telegram as having “become the new dark web” and linked it to investment scams, romance scams, sextortion and digital-arrest fraud.
Telegram founder Pavel Durov had said the ban punished 150 million ordinary users and accused Reliance of lobbying for it, pointing to Meta’s stake in Jio. The Delhi High Court upheld the block, calling it the least restrictive option available.
Asked about the WhatsApp username change, a senior MeitY official, who did not want to be named, told ThePrint, “WhatsApp should be scared and not us.”
‘It only restricts you to Meta ecosystem’
Dhruv Garg, a technology policy lawyer with the Indian Governance and Policy Project, said the feature has a clear upside because of what a username cannot do.
“What does a username on WhatsApp do? It only restricts you to the Meta ecosystem,” he said. Someone with only a username can trace a person across WhatsApp, Instagram and Facebook, but not beyond, how a phone number allows.
Garg tied this to the harassment women face, where a person gets a number through a WhatsApp chat and keeps calling or texting even after being blocked. A username shuts that route. He also warned against overstating the change. “It is just adding another layer over a phone number,” he said, arguing the privacy risk would have been higher had WhatsApp gone from anonymous handles to mandatory numbers.
The flexibility cuts both ways. Garg’s first concern was spoofing. Because usernames can be changed, a fraudster could copy a person’s handle and make a near-identical one to reach their contacts. “Let me make a username very similar to what [a friend’s] username is and then try to connect,” he said. That risk is highest when two strangers speak for the first time, before there is any chat history to judge the person by.
His second concern was traceability. A username can be changed after a crime, so a scam may start under one handle and end under another, leaving the victim with a name that points nowhere. Garg said he assumed Meta keeps backend logs linking old usernames to accounts. On blocking, he said it should work automatically. “If I’m blocking a username, a number should also be blocked, underlying, even if I don’t see the number,” he said.
Not everyone is worried. An industry expert, who did not wish to be named, pointed to the optional PIN as the part of the feature most people had missed.
“It’s a great new feature. Because besides the name it also requires a pin. You can set up the pin,” the expert said. He compared it to Zoom, where a room number is useless without a passcode, and said a person could share a handle at an event without sharing a number. “So it’s not like you can just slide into [someone’s] DMs and say hi. I need to also have your pin,” the expert said. “Don’t see this becoming a fraud/scam entry point… broadly don’t see this being a big issue.”
Rajesh Chhabra, general manager (APAC), Large Markets, Acronis told ThePrint that letting people connect via usernames instead of requiring them to hand over phone numbers is a win for privacy and security.
“It gives people greater power to take control over their personal information and reduces the risk of phone numbers being harvested for phishing, spoofing and other social engineering attacks on a large scale,” he said.
However, this feature alone will not eliminate scams, as cybercriminals primarily exploit trust, urgency and impersonation, he added. Further, Chhabra said, “Given the scale of messaging platforms and the increasing focus of governments and regulators on online fraud and digital identity, any significant change to user identity management is likely to attract regulatory attention.”
He said that the presence of a username alone is not a security concern; however, the key question is whether the platform can effectively prevent identity abuse and impersonation through strong identity verification, proactive detection of fake or look alike accounts, behavioural analysis and efficient reporting mechanisms.
But ultimately, the success of this feature will depend on whether privacy enhancements are matched with equal enhancements in identity protection and continued cooperation between platforms, cybersecurity providers, regulators and law enforcement to keep up with the ever evolving threats, Chhabra added.
Why police are worried
In the case of cyber investigators, they have concerns and their experience with Telegram explains why.
A senior officer with the Delhi Police’s IFSO (cyber) unit said phone numbers have long made tracking suspects easier. “It was easier to track people using phone numbers that were very accessible, but now, having only username as an identity is a hindrance, a bottleneck for cyber frauds that are anyway getting advanced.”
On Telegram, the officer said: “The only way to get information regarding an account is by writing to Telegram, and cyber frauds happen quickly. It’s a time taking process.”
The cyber fraud the officer kept coming back to is digital arrest, now among India’s most common cybercrimes. Fraudsters posing as CBI, police or Enforcement Directorate officials keep victims on hours-long video calls, using fake police-station backdrops and forged documents, until they transfer money.
The National Cybercrime Reporting Portal recorded more than 30,000 digital-arrest complaints in 2025. Impersonation drives the scam, which is why officers see number-free, changeable handles as a risk.
A second officer, from Ahmedabad Crime Branch’s Cyber Cell, said existing features already slow cases down. Disappearing messages and view-once photos are a problem “because evidence cannot be recorded, and cyber fraudsters make use of these gaps”.
On the new feature, the officer said: “Now, if the feature only allows username, people will have disguise and deceptive handles. It will be easier to defraud people.”
Both officers made the same point the courts leaned on in the Telegram case. “WhatsApp and Meta are more supportive with investigation details, than Telegram,” one said.
For now, this is only a reservation window. The full rollout is expected country by country over the coming months.
This is an updated version of the report
(With inputs from Samridhi Tewari)
Also Read: Venezuelans use WhatsApp to trace the missing after devastating earthquake