Explained: What WhatsApp’s username feature means for users, privacy, impersonation, and regulation

WhatsApp’s upcoming username feature is intended to let users connect without sharing their phone numbers, marking one of the biggest changes to the messaging platform in years. While the feature is designed to enhance privacy, it has also sparked questions around impersonation, fraud, platform accountability and data protection, prompting the Centre to seek an explanation from Meta.

Responding to the government’s notice, WhatsApp said the feature has not yet been launched and will be rolled out gradually later this year. The company maintained that usernames are aimed at improving user privacy and that multiple safeguards have been built to prevent abuse. Here’s what the feature means and the questions it raises.

Responding to questions from Fortune India, a WhatsApp spokesperson said, “Usernames is rolling out slowly and will only be available globally later this year. This is a moment where people can start reserving their usernames. We’re taking our time to get it right and listen to feedback.”

Why is WhatsApp introducing usernames?

Usernames are designed to make the platform more private by allowing people to connect without revealing their phone numbers. “WhatsApp is primarily a private messaging app that people use to connect with friends and family. Usernames are our latest step to make WhatsApp even more private,” a WhatsApp spokesperson told Fortune India.

Unlike many social platforms, WhatsApp said there will be no public directory or username suggestions. Someone trying to contact a user for the first time must know their exact username, making it harder for strangers to discover accounts.  The company has also introduced an optional “username key”, which users can enable to add another layer of control over who can message them through usernames.

What safeguards has WhatsApp put in place against impersonation and scams?

WhatsApp said it has built multiple layers of protection before the feature’s wider rollout. Existing Facebook and Instagram usernames will be reserved for their owners during the reservation period and for a limited time afterwards. High-profile usernames, including those belonging to public figures, celebrities, government entities and verified Meta accounts will be held back so that only their legitimate owners can claim them. The company said it has also reserved certain lookalike variations to reduce impersonation.

Beyond username reservations, WhatsApp said its automated systems will detect suspicious behaviour by limiting how many new users an account can contact through usernames, blocking repeated attempts to guess a person’s username key, and restricting how frequently usernames can be changed.

“On top of that, our automated systems detect and remove activity or ban accounts showing common impersonation and abuse patterns. For example, we will limit how many new people any account can contact through usernames and block repeated attempts to guess someone's username key. We also limit how often users can change their usernames to protect against abuse,” the spokesperson said.

 The company added that it will ban accounts or revoke usernames where it finds evidence of impersonation or scams.

If someone is scammed using a fake username, who is responsible?

Under the current legal framework, responsibility primarily rests with the scammer rather than the platform. “WhatsApp is not liable because it is an intermediary,” said Nikhil Narendran, Partner – TMT, Trilegal.  However, he noted that the legal position may evolve as online fraud becomes more sophisticated.

“Law will have to evolve to take into consideration such a change. Increasingly, we are seeing a tendency where courts are asking platforms to take more measures to ensure that frauds at scale are not happening on their platforms. Very soon, we will likely see laws which will require platforms to take increased verification and fraud prevention mechanisms,” he said.

Is removing fake usernames after they are reported enough?

WhatsApp says users will continue to receive contextual information whenever someone outside their contacts messages them for the first time, whether through a phone number or a username. “Just like we do today, when usernames launch later this year and you receive a message for the first time from someone who is not saved to your contacts - regardless of if they are using a phone number or a username - we will show you details in the message that you can use to determine how to respond.”

The platform will indicate whether the sender is a new account, whether users share any groups, whether the person is already a contact, and whether the account is based in another country. Users can then choose to add the sender, mark them as trusted, block or report them. The company also encourages users to report accounts they believe are impersonating someone else.

Legal experts, however, believe expectations from platforms are changing. Narendran said courts are increasingly expecting digital platforms to proactively prevent fraud rather than relying solely on user reports, suggesting that future regulations could mandate stronger verification and fraud prevention mechanisms.

Does linking usernames with Meta’s ecosystem raise privacy concerns?

For most users, WhatsApp recommends choosing a unique username. However, creators, businesses and organisations will be able to reserve their existing Facebook or Instagram usernames to maintain a consistent identity across Meta’s platforms.

According to Narendran, this could have implications under India’s data protection regime if information is shared across services. “Interconnection of various accounts will require consent if it involves data sharing under India’s new data protection regulation,” he said.

WhatsApp has not said that reserving a matching username automatically results in data sharing between its services.

Will usernames change WhatsApp Payments or lead to new regulations?

Narendran said the introduction of usernames is unlikely to affect WhatsApp Pay because payments continue to rely on the Unified Payments Interface (UPI).  “WhatsApp Pay is a UPI-based payment solution, and this change is unlikely to have an impact on WhatsApp. The unique identifier under the UPI scheme will continue to be the unique identifier for payments,” he said.

More broadly, he expects regulators to tighten rules around identity verification and fraud prevention on digital platforms.  “We are moving to an era where the Department of Telecom and MeitY is increasingly asking such platforms to increase safety measures such as in relation to SIM binding and periodic logout of web-based sessions. We can expect more regulations to curb fraud and online crimes in the near future,” he said.