India recorded 24.65 lakh cyber fraud complaints. AI scams, digital arrests, fake investment schemes and identity theft are already rising rapidly.
WhatsApp is preparing one of its biggest identity changes since the messaging platform was launched.
Instead of sharing your phone number with everyone you chat with, users will soon be able to connect using unique usernames. The feature promises greater privacy. But cybersecurity experts say it could also create an entirely new playground for scammers.
The timing couldn’t be more critical.
India recorded 24.65 lakh cyber fraud complaints, according to data from the Ministry of Home Affairs. AI-powered scams, digital arrests, fake investment schemes and identity theft are already rising rapidly. Experts believe introducing a new digital identity layer could unintentionally give fraudsters another tool to exploit.
Among those raising the alarm is Kanishk Agrawal, Chief Technology Officer at Judge Group India, who believes the benefits of usernames must be matched with stronger security awareness.
“Privacy and security must evolve at the same pace as our digital identities,” Agrawal says, adding that convenience should never come at the cost of trust.
What Is WhatsApp’s Proposed Username Feature?
For years, WhatsApp has relied entirely on phone numbers to identify users. That is about to change.
The company is introducing optional usernames that let users message people without revealing their mobile numbers. Instead of exchanging phone numbers, users can share a unique username, much like platforms such as Telegram, Signal, Instagram or X.
The feature is optional and users will still need a phone number to create a WhatsApp account. However, once usernames become available, people messaging you for the first time may only see your chosen username instead of your number, if you enable the feature. WhatsApp has also said usernames won’t be publicly searchable and users will need to know the exact username to initiate contact.
The rollout, however, has already attracted scrutiny in India.
The Centre recently asked WhatsApp to pause the rollout and explain how it plans to prevent impersonation, phishing and cyber fraud before expanding the feature.
Why Are Cybersecurity Experts Worried?
According to Kanishk Agrawal, every new digital identity creates a fresh attack surface. Today’s cybercriminals don’t merely hack devices. They manipulate people.
By combining fake usernames with AI-generated messages, deepfake images and sophisticated social engineering techniques, fraudsters can make scams appear remarkably convincing.
Here are six risks Agrawal believes every WhatsApp user should understand.
1. Fake usernames could make impersonation much easier: Imagine receiving a message from someone whose username looks almost identical to your bank, your employer or even a close friend. A single missing letter, extra underscore or altered spelling may go unnoticed. According to Agrawal, scammers could register usernames resembling trusted individuals or businesses and use them to deceive unsuspecting users.
How to stay safe: Always verify a person’s identity outside WhatsApp before sharing confidential information or transferring money. If something feels unusual, call them directly.
2. Phishing messages may become even more convincing: Cybercriminals have long relied on fake links and urgent messages. Usernames could make these scams appear even more authentic. Agrawal warns that fraudsters may send messages asking users to click malicious links, reveal OTPs or share banking credentials while pretending to be legitimate contacts.
How to stay safe: Never share OTPs, passwords, PINs or banking information over chat, regardless of who appears to be asking.
3. Brand spoofing could become harder to detect: Customer support scams already cost victims millions. With usernames replacing visible phone numbers, fake business accounts could appear more credible than before. According to Agrawal, scammers may impersonate banks, e-commerce companies, delivery platforms or payment apps to trick users into revealing sensitive information.
How to stay safe: Only communicate with verified business accounts and use official customer support channels listed on company websites.
4. AI-powered social engineering may become even more dangerous: Artificial intelligence has dramatically changed cybercrime. Today’s fraudsters can generate realistic conversations, cloned voices and convincing images within minutes. Agrawal says fake usernames combined with AI-generated content could significantly increase the success rate of social engineering attacks. Someone pretending to be a family member or colleague may sound far more believable than before.
How to stay safe: Be extra cautious whenever someone requests money, investment transfers or sensitive financial information. Pause and independently verify every request.
5. Greater privacy could also reduce accountability: The biggest advantage of usernames is also one of their biggest challenges. Hiding phone numbers enhances user privacy. But it may also make it harder to identify pranksters, scammers and malicious actors. Agrawal believes this increased anonymity could complicate investigations unless supported by robust platform safeguards.
How to stay safe: Enable WhatsApp’s two-step verification, review your privacy settings regularly and avoid accepting chats from unknown users without verification.
6. Fraud networks could scale much faster: Scammers rarely operate alone. Many fraud syndicates already manage thousands of fake digital identities. Agrawal says usernames could make it easier for cybercriminals to create and operate large numbers of fraudulent accounts across different regions, increasing the scale of phishing campaigns.
How to stay safe: Report suspicious usernames immediately. Just as importantly, educate family members — especially senior citizens and first-time internet users — about emerging scam techniques.
Convenience Shouldn’t Come At The Cost Of Trust
WhatsApp maintains that the username feature is designed to improve privacy and includes safeguards against misuse. The company says usernames are optional, protected and not searchable, while phone numbers remain linked to accounts behind the scenes.
