India to WhatsApp: Halt Usernames Amid Fraud Fears! 🚨

The Indian government has asked Meta, the parent company of WhatsApp, to put its newly announced Username feature on hold. This request comes just days after the feature's unveiling, driven by serious concerns over potential online fraud, phishing, digital arrest scams, and impersonation attacks. The Ministry of Electronics and Information Technology (MeitY) issued a notice to WhatsApp's chief compliance officer in India, demanding a detailed explanation within three days.

WhatsApp introduced the Username feature on June 29, touting it as a way to enhance user privacy by allowing communication without sharing contact numbers. The company also stated that it would benefit creators, small businesses, and organizations needing a consistent online presence. An optional "username key" was introduced to strengthen privacy, requiring both the username and key for contact.

However, the announcement met with a mixed reception. While some of WhatsApp's 3 billion users rushed to reserve usernames, prominent Indian founders and CEOs voiced strong concerns about identity fraud. Paytm founder Vijay Shekhar Sharma, for instance, warned on X about the potential for unverified, similar-sounding usernames leading to scams.

Experts believe India is particularly vulnerable to these risks. Apar Gupta, a lawyer and co-founder of the Internet Freedom Foundation, highlighted that Indian banks, small shops, and government offices frequently use WhatsApp, and WhatsApp Pay integrates with UPI. This widespread use means a fake handle, if it looks legitimate, could be used to siphon money. Gupta noted that the Digital Personal Data Protection Act, 2023, won't be fully in force until 2027, leaving users with little recourse beyond police complaints after a fraud occurs. He also criticized WhatsApp's approach to usernames, pointing out the inevitable clash of common Indian names and the lack of a clear mechanism to recover a taken name.

Many users who tried to reserve usernames faced the issue of their preferred names already being claimed. While there's no legal right to a username, a registered trademark offers stronger protection against infringement. Gupta dismissed the much-touted "username key" as merely an anti-spam tool. He argued it controls who can message a user initially but does nothing to prevent impersonation, especially when someone pretends to be you to fool a third person, or within existing contacts who don't need a key.

Meghna Bal, director of the Esya Centre, a technology policy think tank in New Delhi, presented an opposing view. She argued that the risks of impersonation should be weighed against the significant privacy benefits. Bal emphasized that a telephone number is a persistent and sensitive identifier linked to numerous personal services. Allowing communication without disclosing it materially reduces unnecessary exposure of personal information. She also noted that WhatsApp requires users to know the exact username to initiate contact and offers additional control through the key, limiting indiscriminate discovery. Bal added that impersonation and digital fraud already occur through phone numbers and cloned profiles, and usernames aren't the sole creators of these problems.

Rajesh Chhabra, general manager for APAC at cybersecurity firm Acronis, agreed on the importance of avoiding phone number sharing and giving users more control. However, he cautioned that security and privacy don't always align. Chhabra predicted that cyber attackers would find more targets once identities shift from phone numbers to usernames, leading to more advanced lookalike usernames, brand impersonation, and phishing attacks. He stressed the importance of protecting one's digital identity beyond just the phone number.

#WhatsAppUsername #DigitalSafety #IndiaTech