The government has asked WhatsApp to explain why regulatory action should not be initiated over a proposal to replace phone nmbers username feature, saying the move could "materially increase the risk of cybercrime", including phishing, impersonation, identity spoofing, financial fraud and "digital arrest" scams. NDTV has accessed a copy of the notice. It has also directed the platform not to roll out the feature in India until consultations with the government are completed.
In a show-cause notice issued to WhatsApp LLC (Meta), the government said it had taken note of the company's announcement of a phased rollout of usernames that would allow users to connect without sharing their mobile numbers. While the feature is aimed at enhancing privacy, the notice said it could make it easier for malicious actors to conceal their identities and target users.
"The proposed functionality has the potential to significantly facilitate cyber fraud by enabling malicious actors to conceal their identity while impersonating trusted entities," the notice said. It added that cybercriminals could create usernames "closely resembling those of individuals, government agencies, financial institutions or other organisations", making phishing and identity spoofing easier.
The government said the feature could undermine efforts to tackle cybercrime at a time when cases of online financial fraud and digital arrest scams are on the rise. "The concealment of mobile numbers from first-time contacts may impede the ability of users and law enforcement agencies to identify and verify the identity of the communicating party," it said.
Citing WhatsApp's obligations as a "Significant Social Media Intermediary", the Centre asked the company to explain why action should not be initiated under the "Information Technology Act, 2000", the "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021" and other applicable laws. The notice specifically refers to "Section 79" of the IT Act, which grants intermediaries safe harbour subject to due diligence obligations, "Rule 4(2)" relating to the identification of the first originator of information, and "Sections 66C and 66D", which deal with identity theft and cheating by personation using computer resources.
WhatsApp has been asked to submit its response, along with supporting documents, within three days of receipt of the notice. The government has also directed the company to "refrain from rolling out the proposed 'username' functionality in India until consultations with this Ministry are completed to its satisfaction." The notice says it has been issued "without prejudice to any further action" that may be taken under applicable law.
