WhatsApp Usernames
On 29 June 2026, WhatsApp announced that users would soon reserve a unique username and use it, instead of their phone number, as the identifier others use to reach them. Days later, India’s Ministry of Electronics and Information Technology ordered the company to pause the rollout, warning the feature “may materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks.” WhatsApp was given three days to respond. As someone advising organisations on both cybersecurity and data protection, I see this as a genuinely difficult trade-off, not a paranoid regulator versus an innovative platform. Both sides have a point, and implementation details will decide who is proven right.

The Good: A Real Privacy Upgrade
From a data protection standpoint, the case for usernames is sound. A phone number is a high-value identifier: it is often linked to national ID and SIM-registration records, it enables SIM-swap attacks, and it exposes users to unsolicited contact the moment it is shared with a stranger, a classmate, or a business. Replacing it with a disposable, revocable handle is a textbook application of data minimisation — sharing only what is necessary for a given interaction. It also brings WhatsApp in line with Signal and Telegram, and gives at-risk users (journalists, activists, domestic abuse survivors, professionals dealing with the public) a genuine tool to control who can find them. Handled well, this reduces the attack surface for harassment, doxxing, and number-harvesting scams that currently thrive on WhatsApp precisely because the phone number doubles as a universal identifier.

The Bad: A New Front Door for Old Scams

The trouble is that a phone number, however imperfect, has functioned as a de facto trust signal in most countries — it typically implies a KYC-verified SIM registration, making it at least theoretically possible to trace a bad actor. Usernames strip that away for first contact. Reporting has already found that handles closely resembling public figures and institutions — variations evoking Presidents, well-known actors, and even Banks — remained reservable during testing, exactly the impersonation vector regulators worry about. This matters enormously in Ghana and many other countries, where “digital arrest” scams — fraudsters posing as police officers, judges, or bank compliance officers to extort panicked victims — are among countries most damaging financial crimes. A username-based first contact removes even the modest friction a phone number provides and could let fraud networks scale outreach faster than victims, or platforms, can react. Meta says it has built in defences: capping how many strangers a new account can message, flagging unfamiliar accounts, and blocking repeated username-guessing attempts. These are sensible controls, but they are reactive rate-limiting, not identity verification — and well-resourced scam operations have shown they can route around rate limits using device farms and disposable accounts.

The Ugly: Evidence, Attribution, and Prosecution

This is where the feature’s second-order effects become genuinely concerning. Law enforcement investigations into WhatsApp-enabled fraud currently lean heavily on subscriber data tied to a phone number, obtainable from domestic telecom operators under relatively fast, well-understood legal process. A username severs that link. Investigators would instead need metadata from Meta itself — often held outside the country in question in most cases — requiring mutual legal assistance requests that can take months, by which time funds have moved and accounts have been abandoned. Usernames are also cheaper to cycle than phone numbers: a blocked or reported handle can be replaced in seconds, while a burner SIM at least carries some acquisition friction. Absent robust, country-accessible metadata retention and expedited disclosure commitments from Meta, this shift risks slowing attribution precisely when speed matters most to victims and prosecutors alike.

It is also fair to note the regulatory overreach concern raised by digital rights groups: but critics argue neither clearly empowers the government to pre-approve or block a specific product feature by administrative letter rather than rule-making. Fraud is ultimately a criminal law enforcement problem; policing it by dictating product design, feature by feature, sets an uneasy precedent for every platform operating in countries.

What Good Implementation Looks Like

Practical mitigation should include verified badges for government bodies, banks, and public figures before general availability; conservative default visibility settings for first-time and older users, who are disproportionately targeted; committed, country-specific SLAs for lawful data requests; and public transparency reporting on username-linked abuse once launched. Regulators, for their part, would do better to legislate clear rules than issue feature-specific letters.

Usernames are neither inherently safer nor inherently riskier than phone numbers — they simply relocate the trust perimeter from telecom-verified identity to platform-managed identity. Whether that trade benefits users or fraudsters will depend entirely on the verification rigour, forensic readiness, and regulatory clarity built in before, not after, the rollout resumes.