India
oi-Madhuri Adnal
The Centre’s concerns over username-based messaging features stem from the possibility of fraudsters impersonating individuals, businesses and government agencies.
Unlike phone numbers, usernames are chosen by users. This means someone can create a username that closely resembles the name of a bank, customer support account, government department or even a public figure. In many cases, a single extra character, number or punctuation mark may not be immediately noticeable, making the account appear genuine.
The Indian government has asked WhatsApp, Telegram, and Signal for details on username features, citing concerns about potential impersonation and fraud, and requested WhatsApp pause its rollout pending consultations.
For example, a fraudster could replace the letter “O” with the number “0”, add an extra underscore or slightly alter the spelling of a username. At a glance, the difference can be difficult to spot, especially on a mobile screen.
Cybercriminals could then use such usernames to contact users, posing as bank officials, customer care executives or government authorities to seek personal information, OTPs or payments. Similar tactics have already been seen in phishing campaigns and so-called “digital arrest” scams.
The risk is not limited to organisations or public figures. A fraudster could also create a username resembling that of an ordinary user and use it to contact their friends, relatives or colleagues with fake requests for money or by sharing malicious links.
Messaging platforms have introduced safeguards to reduce such risks. WhatsApp has said its proposed username feature includes built-in protections against scams, impersonation and unwanted contact. Telegram and Signal also allow users to report accounts suspected of impersonation or misuse and have policies governing username-based accounts.
However, the government wants more clarity on whether these safeguards are sufficient to prevent online fraud, phishing, impersonation and other cybercrimes before username features become more widely adopted.
The issue gained attention after the Ministry of Electronics and Information Technology (MeitY) issued notices to Telegram and Signal seeking details about their username features and the measures in place to prevent misuse. The notices came a day after the Centre sent a similar communication to WhatsApp, directing the Meta-owned platform to pause the rollout of its proposed username feature until consultations are completed.
