India Government Orders WhatsApp to Halt Username Feature Over Cybercrime Fears
The Indian government has directed Meta-owned WhatsApp to pause the rollout of its new username feature in the country until further consultations are completed. The Ministry of Electronics and Information Technology (MeITY) issued a notice to WhatsApp's chief compliance officer, expressing concerns that the feature could increase online fraud, phishing, and digital arrest scams.
The notice stated that while the feature offers privacy benefits by allowing users to connect without sharing phone numbers, it could also make it easier for malicious actors to contact unsuspecting users. The government flagged risks of identity spoofing through usernames resembling those of individuals, public authorities, financial institutions, and government agencies.
Citing the Information Technology Act, 2000, and the IT Rules, 2021, the notice asked WhatsApp to explain within three days why regulatory action should not be initiated for launching a feature that may increase cybercrimes. It reminded WhatsApp that as a 'significant social media intermediary,' it must comply with due diligence requirements, including provisions related to impersonation, identity theft, and tracing the first originator of messages when lawfully required.
WhatsApp has been directed to furnish a detailed explanation with supporting documents and not to launch the feature in India until consultations with the government are concluded to its satisfaction.
In response, a WhatsApp spokesperson said the username feature has not yet gone live and will be rolled out gradually later this year. The company stated that users will still require a phone number to use WhatsApp, and usernames are designed to add an extra layer of privacy, not replace existing account verification. WhatsApp added that public figures, government entities, celebrities, and verified Meta accounts will have their usernames reserved to prevent impersonation, and lookalike variants will be blocked.
The company also highlighted safeguards built into the feature, including limits on how many new users an account can contact, protections against repeated attempts to guess usernames, and systems to detect impersonation and abusive behaviour.
