Centre directs Meta to hold WhatsApp username launch, flags fraud risks

Amid concerns of impersonation and fraud, the central government on Wednesday issued a notice to Meta regarding the controversial username feature on WhatsApp in India. The platform was asked not to roll out the feature until consultations on the issue are completed "to the satisfaction of the Government".

The government also gave Meta three days to furnish a detailed explanation on the feature, backed by relevant documents. In the notice, the government expressed concern that the WhatsApp username feature may "materially increase" cases of online fraud, phishing, digital arrest scams, and impersonation attacks by enabling bad actors to solicit and message victims.

It has asked Meta to explain why action shouldn't be initiated under IT Act and rules over WhatsApp's new feature that may increase cybercrimes.

The Centre has also reminded Meta that WhatsApp, as a significant social media intermediary, is bound by due diligence obligations under the IT Act and rules.

WhatsApp, in a statement on Wednesday, defended the feature, citing built-in safeguards to prevent scams and impersonations and protect users.

India is WhatsApp's largest market, with more than 500 million users.

"It is felt that the feature may materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks, by enabling bad actors to solicit and message victims.

"Furthermore, this feature may facilitate impersonation and identity spoofing, including impersonation of individuals, public authorities, financial institutions, and government agencies, by permitting the adoption of usernames closely resembling those of genuine persons or institutions," said the notice addressed to Chief Compliance Officer, WhatsApp India Operations.

The notice cited provisions of the Information Technology Act and the IT Rules, 2021, including Section 79 on intermediary due diligence obligations, portions of rules 3 and 4 governing intermediary responsibilities and lawful identification of the first originator of messages, as well as Sections 66C and 66D that deal with identity theft and cheating by impersonation using computer resources.

It also referred to intermediary liability under Section 79(3)(a) of the IT Act for aiding, abetting or inducing unlawful acts.

The notice also directed Meta not to roll out WhatsApp's new feature until the consultation on this point is achieved "to the satisfaction of the Government".

A WhatsApp spokesperson said the ability to use a username is not yet live and will roll out slowly later this year.

"To protect against impersonation, we’ve held the highest-profile names - think public figures, government entities, celebrities, verified Meta accounts - so they can only ever be claimed by their legitimate owners and lookalike derivatives of known names are held as well," a WhatsApp spokesperson said.

Users still require a phone number to use WhatsApp, Meta said and added that it has built multiple layers of defence against scams into usernames.

WhatsApp will show whether a first-time sender is a new account, contact, mutual group member or from another country before users respond.

Earlier in the day, government sources indicated that authorities would also examine the legal framework governing the feature and whether existing laws provide for restricting its rollout if it is found to pose risks to public safety or national security.

WhatsApp plans to introduce a username later this year, allowing users to communicate without sharing their phone numbers. The Meta-owned messaging platform has maintained that the feature is designed to enhance privacy, particularly in group chats and interactions with new contacts.

WhatsApp had already begun allowing users to reserve usernames.

The notice to the tech giant comes amid widespread concerns over the feature, with cybersecurity experts and startup founders warning that lookalike usernames could be exploited unless robust verification and anti-impersonation safeguards are introduced.