WhatsApp has begun rolling out username reservations ahead of the feature's official launch later this year, allowing users to connect without sharing their phone numbers.
While the update is designed to improve privacy, it has already raised concerns among cybersecurity experts and government officials, particularly in India, WhatsApp's largest market with more than 500 million users.
The new feature will allow people to find and message each other using a unique username instead of a phone number. Although Meta says this gives users more control over their privacy, critics believe it could also make it easier for scammers to impersonate trusted individuals and organizations.
During early testing, several usernames that closely resembled well-known public figures and institutions were reportedly still available to reserve. These included usernames similar to those associated with Indian Prime Minister Narendra Modi, actors Shah Rukh Khan and Amitabh Bachchan, telecom company Jio, and the Reserve Bank of India.
Meanwhile, Changpeng Zhao, the founder of Binance, revealed on X that he was unable to reserve "cz_binance," the username he already uses on the platform.
When asked about impersonation risks, Meta said it reserves usernames for public figures, government agencies, and "some variations" of those names so only legitimate owners can claim them.
However, the company did not explain exactly how it decides which similar usernames should be blocked and which remain available.
The issue has attracted the attention of Indian regulators.
According to reports, India's Ministry of Electronics and Information Technology (MeitY) has sent a formal notice to WhatsApp warning that the new feature could increase cases of fraud, phishing attacks, impersonation, and so-called "digital arrest" scams.
The ministry stated that usernames resembling government agencies, banks, public officials, or financial institutions could be misused to deceive people into believing they are communicating with legitimate organizations.
Regulators also asked WhatsApp to explain why action should not be taken under India's IT laws and requested that the company delay the wider rollout until further discussions take place.
A senior government official also confirmed that authorities are actively discussing the issue with WhatsApp.
Not everyone agrees with the government's response.
The Internet Freedom Foundation (IFF), a digital rights organization based in New Delhi, argued that while impersonation is a real concern, governments should punish criminals rather than dictate how technology companies design their products.
The organization said:
"Impersonation and fraud are real risks, but they are met by enforcing the criminal law against those who commit them. They are not met by MeitY deciding, in private and by letter, what features Indians may use."
The discussion also reflects concerns raised previously by the Delhi High Court in a separate case involving Telegram. The court noted that usernames, while useful, could make it easier for users to hide their identities and spread illegal content more quickly.
Cybersecurity experts say the feature offers both advantages and risks.
Rachel Tobac, CEO of SocialProof Security, believes usernames are a major privacy improvement because users no longer need to share their phone numbers, reducing the risk of SIM-swap attacks, phishing attempts, and account takeovers.
However, she warned that fake or lookalike usernames could still be used to impersonate trusted individuals.
"Ultimately, usernames are a great idea to avoid leaking your phone number to folks you don’t know, but it’s important to verify identity with the username function too," Tobac told TechCrunch.
She also encouraged users to choose unique usernames that are difficult to guess, making it harder for scammers or strangers to find and contact them.
WhatsApp has acknowledged that usernames will not work the same way for everyone.
The company says most users should create a unique WhatsApp username. However, businesses, creators, and public figures can also link their Facebook or Instagram accounts to claim the same username across Meta's platforms, helping them maintain a consistent online identity while reducing the risk of impersonation.
The Mozilla Foundation also believes the feature introduces new trade-offs.
The organization warned that fake usernames could increase scams and impersonation attempts, even though hiding phone numbers offers better privacy. Mozilla also noted that allowing users to carry the same identity across Meta's apps highlights the company's growing control over digital identity, while users still cannot easily transfer that identity to competing platforms.
For now, WhatsApp says it is taking a cautious approach before launching the feature worldwide.
In its FAQ, the company stated:
"We're taking our time and listening to feedback so that when it rolls out later this year we get it right."
As WhatsApp continues testing the feature, the debate highlights the challenge of balancing stronger privacy with protecting users from online fraud and identity impersonation.
