What's Wrong with Whatsapp Usernames- Explained!
A journalist opened WhatsApp's username reservation system and searched for "rbi_verify." It was available. So was "shahrukh.actor." So was "indiamodi." A feature designed to reduce fraud had, within hours of opening for reservations, created an unclaimed catalogue of every impersonation handle a scammer could want.
The idea behind WhatsApp usernames is genuinely good. Phone numbers are personal in a way that creates real risk — share your number with someone you later distrust, and that number can be used to find you, harass you, or be passed along to people you've never met. A username gives you a layer of separation, a handle you can hand out freely without exposing the underlying contact detail that links to your bank, your SIM card, and your identity. Telegram has had this for over a decade. Signal launched it in 2022. WhatsApp, with three billion users, was the last major holdout.
So why has the rollout — within days of opening username reservations — managed to anger regulators, alarm security researchers, embarrass a sitting politician, and prompt a viral warning from one of India's most followed business influencers? Because the feature has problems that go beyond whether it's a good idea in principle. The problems are in the details — the specific design choices, the gaps in the safeguards, and the fundamental tension at the heart of what usernames do on a platform this large.
The Test That Revealed Everything in an Hour
Within hours of WhatsApp opening username reservations, TechCrunch ran a straightforward experiment: search for handles that any reasonable person would consider obvious impersonation targets. The results were not encouraging.
Handles including "indiamodi," "shahrukh.actor," "teamamitabh," "ambanijio," and "rbi_verify" were all available to claim. These aren't obscure handles that might slip through automated filtering. They are specific references to India's Prime Minister, one of Bollywood's most recognisable actors, a business dynasty's most prominent family member, and the Reserve Bank of India — one of the most impersonated institutions in financial scams targeting Indian users. All of them unclaimed. All of them one tap away from being registered by anyone with a WhatsApp account and a creative enough username in mind.
WhatsApp says it has reserved usernames for public figures and prominent institutions. What TechCrunch's testing revealed is that the reservation system wasn't applied comprehensively or proactively at launch — at least not across the most obvious targets. Whether those handles have since been claimed or reserved by WhatsApp's own team in response to the reporting is unknown. But the initial window, in the hours when username reservation opened to the public, was a gap that demonstrated the limits of the safeguard in practice rather than in policy documents.
The Lookalike Problem — Ankur Warikoo Put It Better Than Any Security Researcher
Ankur Warikoo, the entrepreneur and educator with millions of followers across social media platforms, posted a warning on X immediately after WhatsApp opened reservations. The post went viral fast enough to shape much of the public conversation that followed. His point wasn't complicated, but it was unusually specific and honest about how this kind of attack actually works.
He laid out the handles a scammer could plausibly register to impersonate him: warikoo, awarikoo, ankurwarikooo, ankur_warikoo, a_warikoo, ankurwarikooofficial. Six variations. All potentially available. Each one slightly different from his real handle — different enough to be registerable, close enough to fool someone who isn't looking carefully. Then imagine one of those accounts sending a message to someone who follows him: "Hi, I'm doing a limited mentorship cohort — here's the payment link." That recipient might check the username, see something that looks right, and act on it.
This is the lookalike problem, and it exists on every platform that has ever used username-based identity. Instagram has struggled with it for years. Twitter verified accounts were partly an attempt to solve it — imperfectly, famously. WhatsApp's particular challenge is that the platform is used for direct communication in a context where trust is assumed. You don't message someone on WhatsApp with the same scepticism you'd read a tweet from an unfamiliar account. Messages arrive in the same interface as messages from your actual contacts. That familiarity is what makes the lookalike attack so potent in this specific context.
The Politician Who Couldn't Reserve His Own Name
Manish Sisodia — former Deputy Chief Minister of Delhi and Aam Aadmi Party leader — attempted to reserve his own username when the feature opened and posted publicly about what happened. He couldn't get it. His own name, in multiple reasonable variations, had already been taken. His post acknowledged that "Manish Sisodia" is not a unique name and that other people legitimately share it — but the practical outcome was that a prominent public figure couldn't secure his own identity handle on a platform with 500 million Indian users.
His situation illustrates a specific design gap that WhatsApp hasn't fully addressed: the difference between verifying that a user is who they claim to be versus simply first-come-first-served allocation of handles. WhatsApp's system is fundamentally the latter. The person who happens to reserve "manishsisodia" first owns it, regardless of whether they are Manish Sisodia. The verified reservation process that WhatsApp describes for public figures apparently wasn't comprehensive enough to protect his own name before general reservations opened.
Vijay Shekhar Sharma, Paytm's founder, made a related observation: even if a verified account secures the "real" version of a prominent person's username, the ecosystem of similar-looking unverified alternatives remains available. Verification of one handle does nothing to close the six-handle attack surface that Warikoo described. Both things can coexist — the real Sisodia account verified by WhatsApp, and four or five lookalike accounts registered by people using his name.
The Privacy Gain Is Real — But It Creates a New Problem for the Same People It's Supposed to Help
Rachel Tobac, the chief executive of SocialProof Security, said something worth sitting with carefully in her TechCrunch interview. Usernames are a net privacy gain because they reduce the need to share phone numbers — and phone number exposure carries real, documented risks. SIM-swap attacks, where criminals hijack your phone number to intercept verification codes and access accounts, are one of the most damaging forms of identity theft. Reducing how often you need to hand out your number to strangers reduces your exposure to that attack.
But Tobac also said this directly: lookalike usernames still create impersonation opportunities. The feature that protects your phone number from strangers also makes it easier for a stranger to pretend to be someone they're not when they contact you. These aren't separate problems. They're the same feature, producing two opposite effects simultaneously depending on whether the account using it belongs to a genuine user or a bad actor.
The Mozilla Foundation's response to TechCrunch was more pointed. It described "increased scams and impersonation from fake handles" as potentially a significant tradeoff, and noted that phone numbers, despite their privacy limitations, served a verification function — a piece of traceable information you could report when something went wrong. Mozilla also raised a broader interoperability concern: as WhatsApp becomes a platform with a username-based identity layer, questions about how that identity travels across platforms and who controls its verification become more consequential. These aren't questions WhatsApp has answered yet.
The Searchability Design Choice — Good Intentioned, Easily Misunderstood
WhatsApp has emphasised repeatedly that usernames are not publicly searchable. You can't open a directory and browse through handles. You can't run a search for "sharma" and get a list of everyone with that string in their username. Someone can only find you by username if they already know your exact, complete handle.
This is genuinely a more privacy-conscious design than Instagram or Twitter. It's also a design that many users will misunderstand in a way that creates risk. If someone puts their real name or their professional name as their WhatsApp username — which the platform effectively encourages by letting you link your Instagram or Facebook handle — and they share that username on a public post, a business card, or a website, the "not publicly searchable" protection evaporates entirely. The handle is now public. Anyone who sees it can use it to reach that person directly on WhatsApp without ever needing their phone number.
The Kartik Dayanand warning that circulated widely on X made exactly this point: the instinct on any username platform is to grab something that reflects your real identity, because a recognisable handle feels like a trust signal. On WhatsApp, that instinct is specifically dangerous — a recognisable handle tied to a real name is an invitation to direct contact from anyone who finds that handle anywhere online, in a messaging context where people tend to lower their guard.
What WhatsApp Says It Built — And Where the Gaps Are
WhatsApp's official safeguard list is specific and worth knowing: first-time contacts via username trigger a visible warning showing the sender's country of origin. No public searchability or discovery through the platform itself. Reserved handles for verified accounts and public institutions. Automated abuse detection on accounts attempting to send unsolicited messages through usernames. Limits on how many times someone can attempt to guess a username to find a specific person. A Username Key feature — a four-digit code layer — that requires anyone messaging you to have both your exact username and this additional code before reaching your inbox.
These are real safeguards. The honest assessment of them is that they address the most obvious attack vectors while leaving others open. The country-of-origin warning helps with international scam attempts and adds visible context to first-contact messages. But it does nothing about a domestic scammer using a lookalike handle to impersonate a local influencer. The abuse detection on unsolicited messaging helps with bulk spam campaigns. It does nothing about a targeted impersonation where one account contacts one specific victim with a convincing story.
The Username Key is the most underrated protection in the list, and it's the one WhatsApp users should activate immediately once the feature fully launches. Requiring both the exact handle and a four-digit code before someone can reach your inbox is a meaningful barrier — not impenetrable, but enough friction to make targeted impersonation attacks considerably harder to execute at scale.
The Real Design Contradiction Nobody Is Talking About
Here's the tension that sits underneath all of it, and that WhatsApp hasn't resolved because it may not be possible to resolve within a single feature. The entire pitch of usernames is that they make WhatsApp safer for genuine users — you don't have to hand out your phone number to strangers, reducing your exposure to the specific harms that phone number exposure enables.
But the feature also makes WhatsApp marginally safer for bad actors — they can operate through a handle that doesn't lead directly to a SIM card registered in a real name, reducing the investigator's ability to trace a conversation back to a physical identity. Both of those things are true simultaneously. WhatsApp's position is that the privacy benefit for hundreds of millions of genuine users outweighs the marginal advantage for a much smaller number of bad actors who already have other tools available to them. India's government's position is that the traceability reduction is unacceptable given the current scale of fraud and the difficulty of investigating it.
Neither position is obviously wrong. The feature creates a genuine trade-off rather than a clear improvement, and reasonable people — regulators, security researchers, privacy advocates — are landing on different sides of it based on which harm they weight more heavily. That's what makes the WhatsApp username situation more interesting and more genuinely complicated than it's being reported in most places — it's not a case of a company doing something clearly reckless or a government being clearly unreasonable. It's a legitimate tension in how a platform with three billion users should balance the privacy of its genuine users against the accountability of the rare ones who intend harm.
What to Actually Do Right Now
If you're a WhatsApp user trying to figure out what this means for how you use the app, a few things are worth doing regardless of how the regulatory situation resolves. Reserve your username now — not because you need to use it immediately, but because your preferred handle will only get harder to claim as more people register theirs. Consider using something that doesn't map directly to your real name, especially if you intend to share that handle publicly. Enable the Username Key feature once it's available in your account settings — it's the one safeguard that meaningfully limits unsolicited contact through your username rather than just warning you about it after it arrives.
And if you receive a message from any username claiming to be someone you know — a public figure, a brand, a business — treat it with the same scepticism you'd apply to a cold email from an address you've never seen before. The username being recognisable is not verification that the person behind it is who they say they are. Until WhatsApp builds a more robust public verification layer, recognisable is not the same as real.
Also read: Samsung Galaxy Watch 9 is 17 days away
