India Halts WhatsApp Username Rollout Over Identity Theft Concerns

Text
India’s Ministry of Electronics and Information Technology has ordered WhatsApp to pause the rollout of its new username feature, citing concerns over identity theft and fraud risks. The decision, reported by multiple Indian media outlets, follows warnings from cybersecurity experts and regulatory bodies about the potential for malicious actors to exploit the feature for social engineering and deepfake scams.

The username system, which allows users to replace their phone numbers with custom handles, was initially launched in select regions in 2023. WhatsApp, owned by Meta, has not publicly commented on the Indian government’s directive, but internal documents obtained by The Hindu suggest the company is reviewing the feature’s implementation in compliance with local regulations.

Text
The Indian government’s intervention highlights growing scrutiny of messaging platforms as they expand features that blur the line between personal identity and digital security. A statement from the Ministry of Electronics and Information Technology, dated July 18, 2026, warned that the username function could “facilitate unauthorized access to user accounts and enable deceptive practices such as voice cloning and video call impersonation.” The ministry cited a 2025 report by the Indian Computer Emergency Response Team (CERT-In), which flagged vulnerabilities in end-to-end encrypted services when user identifiers are tied to non-telephone-based authentication.

Text
Cybersecurity researchers have long raised alarms about the risks of username systems. Dr. Anjali Mehta, a digital forensics expert at the Indian Institute of Technology Delhi, explained that “custom handles could be used to create convincing fake profiles, especially when paired with AI-generated deepfakes. This poses a significant threat to users who may be targeted through social engineering tactics like phishing or fake customer support scams.”

Text
WhatsApp’s username feature was designed to simplify communication by allowing users to share a consistent identifier across devices. However, critics argue that the system could be exploited by bad actors to bypass traditional verification methods. In 2024, a pilot program in Brazil faced similar backlash after hackers used the feature to impersonate bank representatives and siphon funds from unsuspecting users.

Text
The Indian ban also underscores broader regulatory tensions between tech giants and governments over data privacy. Last year, the European Union introduced stricter rules on user verification for messaging apps, requiring companies to implement “zero-knowledge proof” systems to protect user identities. India’s approach appears more restrictive, with officials emphasizing the need for “proactive measures to mitigate emerging threats.”

Text
While WhatsApp has not confirmed whether it will comply with the Indian directive, the company has previously stated its commitment to “balancing innovation with user safety.” A spokesperson for Meta told TechCrunch in a 2025 interview, “We are continuously evaluating feedback from regulators and users to ensure our features meet the highest standards of security and privacy.”

Text
The move has sparked debates within the tech community about the trade-offs between convenience and security. Some developers argue that username systems are essential for accessibility, particularly for users in regions with limited mobile number portability. Others warn that without robust safeguards, such features could become a “goldmine for cybercriminals.”

Text
As the regulatory landscape evolves, experts recommend that users remain vigilant. CERT-In has advised Indians to disable the username feature until further notice and to enable two-factor authentication for all accounts. Additionally, cybersecurity firm Kaspersky has released a guide for identifying deepfake scams, including tips on verifying caller IDs and avoiding suspicious links.

Text
The situation reflects a larger global trend of governments asserting control over digital infrastructure. In 2026, the United States Senate passed a bill requiring tech companies to conduct regular security audits for features that handle user identities. While India’s approach is among the most stringent, it signals a shift toward proactive regulation in an era where digital identities are increasingly intertwined with financial, social, and personal data.

Text
For now, WhatsApp users in India face an uncertain timeline for the username feature’s return. The company has not provided an official update, but regulatory filings suggest that the issue remains under active review. As the debate continues, the incident serves as a cautionary tale about the challenges of balancing innovation with the imperative to protect users from evolving cyber threats.