Tag: phishing

  • Crypto Security Best Practices: Safeguard Your Investments with These Expert Tips

    Crypto Security Best Practices: Safeguard Your Investments with These Expert Tips

    Storing cryptocurrency securely is essential for every investor. Hardware wallets such as Ledger or Trezor provide offline storage that keeps private keys away from hackers and malware. For long-term holdings, a hardware wallet is the safest option.

    Your recovery seed phrase must be protected at all costs. Write it down on paper or metal and store it in a safe place. Never save it in cloud storage, emails, screenshots, or phone notes—any digital copy increases the risk of theft.

    Enable two-factor authentication (2FA) using an authenticator app or a hardware security key instead of SMS-based 2FA. This prevents SIM-swap attacks and adds an extra layer of security to your exchange accounts.

    Use a unique, strong password for every crypto account and store them in a trusted password manager. Activate withdrawal whitelists and security alerts to monitor any suspicious activity.

    Phishing scams are rampant. Always bookmark the official websites of your exchanges and use those bookmarks to log in. Never click login links from emails, social media posts, ads, or random direct messages.

    Additional best practices include keeping most of your funds in cold storage, regularly updating your devices, verifying wallet addresses before sending any transaction, and never sharing your seed phrase or private keys with anyone.

  • Avoid These Critical Crypto Security Mistakes to Protect Your Digital Assets

    Avoid These Critical Crypto Security Mistakes to Protect Your Digital Assets

    Overview

    Most cryptocurrency losses result from operational security mistakes such as weak passwords, unsafe wallet approvals, poor seed phrase handling, and phishing attacks rather than vulnerabilities in blockchain technology. Modern wallet drainer scams exploit token approvals, malicious smart contracts, and deceptive signature requests, making user awareness a critical layer of crypto wallet safety. A risk-based security approach that prioritizes stronger authentication, secure self-custody, regular approval reviews, and offline recovery planning can significantly reduce the chances of losing digital assets.

    The Approval You Didn’t Read is the New Front Door

    Many DeFi apps ask a wallet to approve a token before a transaction can go through. That approval lets the app move the token later, without asking again. Attackers use this same setup against people. A fake airdrop page, or a cloned DeFi site, asks for a signature that looks routine. Once someone signs it, the malicious contract can pull funds out whenever it wants, sometimes months after that first click. Since the transaction was technically approved, there’s no way to undo it on the blockchain.

    This has turned into a real criminal business. Drainer kits get rented out to attackers who barely know any code, complete with phishing pages and contracts already built and ready to use. Some scams even copy the ‘revoke approvals’ warnings that security teams send out after a hack, aiming at people who are just trying to stay safe. Many wallets now run a quick simulation before signing and flag anything that looks like a suspicious permission request. That warning is worth stopping for. The fix is simple enough: check pending approvals now and then, using the wallet’s own permissions screen or a trusted revocation tool, and cancel anything unused or unlimited.

    Password Reuse Still Opens the First Door

    Reused passwords let credential-stuffing attacks work. When one unrelated website leaks a password, automated tools test that same password against exchange and wallet-service logins elsewhere. A single reused password can compromise several accounts at once. A password manager generating unique credentials per account closes this gap with almost no daily effort.

    SMS Two-Factor Authentication has a Known Weakness

    Two-factor authentication blocks most password-only attacks, but not all 2FA is equal. SMS-based codes are more exposed to SIM-swap attacks, where an attacker convinces a carrier to port a phone number to a new SIM and intercepts the verification code. App-based authenticators or hardware security keys remove that specific weak point.

    Seed Phrases are the Master Key Rather than a Backup Note

    A seed phrase regenerates every private key in a wallet. Storing it in a screenshot, a notes app, or cloud storage puts the entire wallet one data breach away from total loss. Offline, physically secured, redundant storage remains the standard advice for a reason.

    Leaving Long-Term Holdings on an Exchange

    Exchanges are convenient for trading but carry custodial risk. An account can be compromised directly, a platform can go offline during high demand, regulatory action can freeze withdrawals, and insolvency can leave user funds unrecovered. Good crypto wallet safety means treating exchanges as a trading tool, not a vault. Assets meant for long-term holding are safer moved into self-custody, ideally a hardware wallet.

    Fix the Highest-Risk Gaps First

    • Critical Today: Use unique passwords made by a password manager. Turn on app-based or hardware-backed two-factor authentication for email and exchange accounts.
    • Important this Week: Go through token approvals and cancel the ones not needed. Move long-term holdings off exchanges and into a hardware wallet or some other self-custody option.
    • Recommended this Month: Keep seed phrases stored safely offline. Put together a recovery plan in case a device gets lost, stolen, or damaged.

    Crypto security works best with several layers of protection, not just one. Strengthening each layer means one single mistake won’t put an entire portfolio at risk.

    Final Thoughts

    Blockchain itself is built to be secure, but keeping cryptocurrency safe really comes down to the everyday choices people make. Checking wallet permissions, keeping recovery details safe, and sticking to a few basic habits can go a long way toward protecting digital assets from threats that keep changing.

    FAQs

    1. What is the biggest crypto security mistake? The most common crypto security mistake is weak account protection. Reusing passwords, skipping strong two-factor authentication, and poor recovery practices make it easier for attackers to gain access to wallets and exchange accounts.
    2. What is a token approval, and why is it risky? A token approval allows a smart contract to access specific cryptocurrency tokens in your wallet. If the approval is granted to a malicious contract, attackers may be able to move approved assets without requesting another permission.
    3. Is a hardware wallet safer than keeping crypto on an exchange? For long-term storage, a hardware wallet is generally considered safer because it gives users direct control of their private keys and reduces exposure to exchange-related risks such as account compromise or platform failures.
    4. Where should I store my seed phrase? A seed phrase should be stored offline in a secure and redundant location, such as a fireproof safe or another protected physical backup. Avoid saving it in cloud storage, screenshots, email, or note apps.
    5. How can I improve my crypto wallet security? Use unique passwords, enable app-based or hardware-backed two-factor authentication, review wallet permissions regularly, revoke unused token approvals, keep seed phrases offline, and move long-term holdings to a trusted hardware wallet or other self-custody solution.
  • Master Gmail Spam Removal in 2026: Essential Tips to Clean Your Inbox

    Master Gmail Spam Removal in 2026: Essential Tips to Clean Your Inbox

    Spam emails have become more sophisticated, but Gmail offers powerful tools to keep your inbox clean. Learn how to use Manage Subscriptions, spam reporting, filters, sender blocking, and smart security practices to reduce unwanted emails, improve inbox organization, and protect your account from phishing and spam attacks in 2026.

    Use Gmail’s New Manage Subscriptions Feature

    Manage Subscriptions is one of the most significant enhancements to Gmail that is meant to ease the process of unsubscribing from newsletters. Rather than having to sift through several promotional emails, Gmail will display all your subscriptions and show you how often each one sends emails to you.

    To use it:

    • Open Gmail.
    • Navigate to Manage Subscriptions.
    • Review your mailing lists.
    • Remove newsletters and promotions you no longer read.

    This feature is especially useful for legitimate marketing emails that accumulate over time without requiring you to open each message individually.

    Report Spam Instead of Simply Deleting It

    Many users delete junk emails immediately. While that removes them from the inbox, it doesn’t help Gmail improve its spam detection.

    Instead:

    • Select the unwanted email.
    • Click Report Spam.
    • Gmail moves the message to the Spam folder and uses the report to improve future filtering.

    Filing repeated spam reports for similar emails makes it easier for Gmail to detect similar campaigns. Emails in the Spam folder are automatically deleted after 30 days. There is no need to empty your Spam folder manually if you don’t want to save space.

    Block Persistent Senders

    Some unwanted senders continue emailing despite repeated spam reports. For these cases:

    • Open the email.
    • Click the three-dot menu.
    • Select Block Sender.

    Future emails from that address will automatically be directed to the Spam folder. However, remember that blocking works best against individual senders. Professional spammers often change email addresses regularly, so blocking alone won’t eliminate every unwanted message.

    Create Filters for Recurring Spam

    If you notice similar promotional emails arriving from different addresses but sharing common keywords or subjects, Gmail filters can automate cleanup. For example, you can filter emails containing:

    • “Congratulations! You’ve won”
    • “Crypto investment”
    • “Exclusive offer”
    • Certain domains or sender names

    After creating the filter, choose actions such as:

    • Delete automatically
    • Skip Inbox
    • Mark as Spam
    • Archive immediately

    Filters are particularly effective for recurring promotional campaigns that Gmail doesn’t automatically classify as spam.

    Never Click Suspicious Unsubscribe Links

    It should be noted that not all unsubscribe buttons are safe. When dealing with trustworthy companies such as Amazon or LinkedIn, for example, using the unsubscribe button is completely acceptable. In case an email appears to be dubious, poorly formatted, and/or sent by an unknown user, never click on any unsubscribe buttons. As cybersecurity experts suggest, phishing unsubscribe buttons may reveal that your email is real and thus result in receiving even more junk mail.

    Protect Your Email Address Before Spam Starts

    Preventing spam is always easier than managing an already overloaded inbox. There are a few tips to prevent any spam emails from reaching you. It is not advisable to share your Gmail address on any website where you are required to enter it. You can create different email accounts for various activities. You should regularly audit the apps that connect to your Google account and remove any app whose services you are not currently using. It is also wise to activate two-factor authentication (2FA), which adds more security to your email account. Be very careful when registering with any new websites or promotional sites.

    When your inbox fills up with hundreds of emails very fast, it could indicate that you have received a mail bombing. The attackers usually do this as a strategy to hide any security notifications that might require action, such as password changes and unauthorized logins.

    Keep Your Inbox Clean with Small, Regular Actions

    A clutter-free Gmail inbox isn’t achieved by deleting thousands of emails in one sitting. Instead, it comes from consistent habits like reporting spam, unsubscribing from trusted newsletters, creating smart filters, and using Gmail’s built-in subscription management tools. With Gmail consistently improving its AI-based spam prevention measures, the combination of Google’s automatic spam filter and some time spent organizing one’s inbox will ensure that the number of spam emails received becomes minimal. Organization is crucial in protecting one from phishing attacks, scams, and other types of spam.

    Why This Matters

    Email remains one of the most important communication tools for work and personal life, making inbox security more critical than ever. As spam, phishing, and AI-generated scam emails become increasingly sophisticated, knowing how to use Gmail’s built-in security and filtering features helps protect sensitive information, improves productivity, and reduces the risk of cyber threats.

    Frequently Asked Questions

    How can I permanently reduce spam emails in Gmail?

    While it’s impossible to eliminate spam, you can significantly reduce it by reporting unwanted emails, blocking persistent senders, unsubscribing from trusted mailing lists, and creating Gmail filters. Regularly reviewing connected apps and enabling two-factor authentication also helps prevent your email address from being misused, keeping your inbox cleaner over time.

    What is Gmail’s Manage Subscriptions feature, and how does it work?

    Gmail’s Manage Subscriptions feature automatically gathers your newsletter and promotional subscriptions into one place. Instead of opening individual emails to unsubscribe, you can view all active subscriptions, see how frequently each sender emails you, and remove unwanted subscriptions with a single click, making inbox cleanup much faster.

    Is reporting spam better than simply deleting unwanted emails?

    Yes. Deleting spam only removes it from your inbox, while reporting it helps Gmail’s AI-powered spam detection system learn from the message. Over time, this improves Gmail’s ability to identify similar spam campaigns and automatically block them before they reach your inbox or other users’ accounts.

    Should I click the unsubscribe link in every promotional email?

    Not always. If the email is from a trusted company such as Amazon, Google, or LinkedIn, using the unsubscribe option is generally safe. However, avoid clicking unsubscribe links in suspicious or poorly designed emails, as scammers may use them to verify that your email address is active and send even more spam.

    How do Gmail filters help remove recurring spam emails?

    Gmail filters let you automatically sort, archive, delete, or mark emails as spam based on criteria such as sender, subject line, keywords, or specific domains. They are especially useful for recurring promotional emails or newsletters that bypass Gmail’s default spam filter yet remain unwanted in your inbox.

  • Crypto Phishing Scams: How to Spot Fake Apps, Websites, and Address Poisoning

    Crypto Phishing Scams: How to Spot Fake Apps, Websites, and Address Poisoning

    Crypto phishing scams have become one of the biggest threats to digital asset users. With more investors using wallets, exchanges, DeFi platforms, and NFT marketplaces, scammers are increasingly deploying fake websites, wallet-draining links, and AI-generated messages to raid crypto wallets.

    According to the FBI’s latest internet crime data reported by The Wall Street Journal, cryptocurrency crime is now the most costly type of internet crime, totaling $7.2 billion. The report also noted a rise in AI-powered scams, with over 22,000 complaints and losses of nearly $893 million.

    What is a Crypto Phishing Attack?

    A crypto phishing scam is a fraud attempt designed to steal wallet credentials, seed phrases, exchange passwords, or transaction approvals. Unlike traditional bank fraud, scammers don’t always need your login information. In some cases, all they need is for you to sign a malicious wallet transaction.

    These scams often appear as fake airdrops, token claim pages, NFT mint links, customer support messages, or urgent wallet verification requests. Once a user connects their wallet and confirms the request, the attacker can drain the tokens.

    How to Identify Fake Crypto Websites

    Fake crypto sites typically copy the design of popular exchanges, wallets, or DeFi platforms. The domain may look similar but with slight differences: misspellings, extra hyphens, strange extensions, or fake login pages.

    Watch for warning phrases like:

    • “Verify Your Wallet Now”
    • “Claim Reward Before Expiry”
    • “Urgent Account Suspension”
    • “Connect Wallet to Unlock Funds”

    A legitimate exchange will never ask for your seed phrase. Always type the official URL directly or use a bookmark. Avoid clicking links from Telegram, Discord, X, WhatsApp groups, or sponsored search results without verification.

    How to Identify Fake Crypto Apps

    Research on cryptocurrency exchange scams uncovered over 1,500 fraudulent domains and more than 300 fake apps, some of which made it to major app marketplaces. Before downloading, verify the app’s history, reviews, and developer name. Check how long it has been available, the official website link, and the app’s reputation. Never download APKs from unknown sources.

    During setup, a fake app may request your recovery phrase under the guise of security verification or customer support. That’s a major red flag.

    Watch Out for Address Poisoning

    Address poisoning is a phishing attack where scammers send small transactions from lookalike wallet addresses. The goal is to trick users into copying the wrong address from their transaction history. A 2025 study found approximately 270 million on-chain address poisoning attempts targeting 17 million victims, resulting in at least $83.8 million in losses.

    Why This Matters

    The escalation of AI-driven phishing and address poisoning matters because scammers no longer need to hack blockchains. By weaponizing urgency and lookalike addresses, they trick users into authorizing irreversible transactions that drain wallets instantly — turning user error into crypto’s costliest threat.

    Final Thoughts

    • Never share your seed phrase.
    • Only download apps from official sources.
    • Store larger amounts on a hardware wallet.
    • Check URLs carefully.
    • Revoke suspicious wallet approvals.
    • Test large transfers with a small amount first.

    Remember the three elements of crypto scams: urgency, fear, and greed. If a message feels urgent, secret, or too good to be true, pause, verify, and proceed only if you’re certain.

    Frequently Asked Questions

    1. What is a crypto phishing scam?

    A crypto phishing scam is a fraud attempt designed to steal wallet credentials, seed phrases, exchange passwords, or transaction approvals. Scammers often use fake websites, airdrops, NFT mint links, or support messages to trick users.

    2. How can I identify a fake crypto website?

    Fake crypto websites often copy real platforms but use slightly changed domains, misspellings, extra hyphens, or unusual extensions. Any site asking for a seed phrase or urgent wallet verification should be treated as suspicious.

    3. Are fake crypto apps dangerous?

    Yes, fake crypto apps can steal recovery phrases, login details, or wallet permissions. Always check the developer name, app history, reviews, and official website before downloading any crypto wallet or exchange app.

    4. What is address poisoning in crypto?

    Address poisoning is a scam where attackers send small transactions from lookalike wallet addresses. The goal is to make users accidentally copy the wrong address from their transaction history and send funds to the scammer.

    5. How can crypto users stay safe from phishing scams?

    Users should never share seed phrases, avoid unknown links, use official app stores, bookmark trusted websites, and test large transfers with small amounts first. Hardware wallets can also improve security for larger holdings.

  • Top Gaming Scams to Watch Out for in 2026: Red Flags You Might Be Missing

    Top Gaming Scams to Watch Out for in 2026: Red Flags You Might Be Missing

    As the gaming industry continues to expand, cybercriminals are refining their tactics to target players. In 2026, scammers are leveraging artificial intelligence, fake giveaways, and fraudulent platforms to steal credentials, money, and personal data. Recognizing these red flags is essential to staying safe while gaming.

    AI-Generated Phishing Messages

    Scammers now use AI to craft convincing emails and messages that mimic official gaming platforms. Never click unsolicited login links or verify accounts through unknown sources. Always navigate directly to the official website.

    Too-Good-to-Be-True Game Deals

    Massive discounts on skins, in-game currency, premium accounts, or collectibles are almost always scams. Purchase digital content only through official stores and trusted marketplaces.

    Fake Giveaways from Popular Creators

    Fraudsters impersonate streamers, esports teams, and developers, promising exclusive rewards. Legitimate giveaways never require passwords, payment details, or account credentials to participate.

    Suspicious Beta Testing Invitations

    Cybercriminals distribute fake beta invites containing malware or phishing links. Download beta versions only after confirming announcements from official game developers.

    Unofficial Trading Platforms

    Private item trading often involves fake buyers, manipulated payment proofs, and fraudulent middlemen. Always use secure, developer-approved trading systems whenever available.

    Malicious Mods and Cheat Software

    Free mods, hacks, cheats, and cracked games may contain hidden malware. Download gaming tools exclusively from reputable creators and verified community platforms.

    Fake Esports Tournament Registrations

    Scammers advertise nonexistent tournaments and collect registration fees or personal information. Verify organizers through official esports websites before entering any competition.

    Impersonated Customer Support Teams

    Fraudsters pretend to resolve hacked accounts while requesting passwords or payments. Authentic support teams never ask for sensitive credentials or cryptocurrency transfers.

    Weak Account Security Practices

    Using simple passwords or skipping multi-factor authentication makes accounts easier to compromise. Strong, unique credentials and MFA provide essential protection against cyberattacks.

  • Top Cryptocurrency Scams Exposed: How to Protect Your Digital Assets in 2026

    Top Cryptocurrency Scams Exposed: How to Protect Your Digital Assets in 2026

    Key Takeaways

    • Always verify investment platforms, people, and offers before sending cryptocurrency.
    • Never share your seed phrase or private keys with anyone under any circumstances.
    • Strong security habits like two-factor authentication and hardware wallets greatly reduce scam risks.

    Millions of people now buy digital coins as they believe these assets have long-term value. At the same time, criminals have found new ways to steal money from crypto users. Most scams do not result from weaknesses in blockchain technology. They happen as scammers trick people into making costly mistakes. Many recent reports show that fraud based on trust, fear, or excitement has become the biggest threat in the crypto world. A careful approach and proper knowledge can prevent many of these losses.

    Pig Butchering Scams

    One of the most common crypto scams is known as a pig butchering scam. In this scam, a scammer spends weeks or even months building trust through social media, dating apps, or messaging platforms. After a strong relationship develops, the conversation shifts toward cryptocurrency investments. The scammer introduces a fake investment platform that appears genuine and even shows false profits. Once a large amount of money goes into the account, withdrawals become impossible. Extra payments, fake taxes, or account verification charges often appear before access to the money is denied. Every investment offer from an online contact deserves careful verification before any payment takes place.

    Fake Investment Platforms

    Fake crypto investment websites have become more advanced than ever. Many look almost identical to trusted exchanges. These websites display fake account balances and impressive profits that never exist in reality. After deposits increase, victims discover that withdrawals require additional payments such as processing fees or taxes. Even after these payments, the funds are never returned. Independent research, company background checks, and reviews from trusted sources can help identify fraudulent platforms before any funds move.

    Phishing Websites and Fake Wallets

    Phishing remains one of the easiest ways for criminals to steal cryptocurrency. Fake websites copy the design of popular exchanges and wallet providers. A single wrong click can lead to a fake login page where passwords or wallet recovery phrases fall into criminal hands. Fake browser extensions and wallet applications create the same danger. Once scammers receive a recovery phrase or private key, complete control of the wallet passes to them. Official website bookmarks, careful checks of web addresses, two-factor authentication, and hardware wallets offer strong protection against these attacks.

    AI Deepfake Scams

    Artificial intelligence has made crypto scams even more convincing. Criminals now create fake videos, cloned voices, and realistic livestreams that appear to feature famous business leaders, celebrities, or crypto experts. These fake promotions often promise free cryptocurrency or guaranteed investment profits. Many ask people to send crypto with the false promise of receiving a larger amount in return. Verify every announcement against official company websites or verified social media accounts before taking any action. A professional video alone should never become proof that an offer is genuine.

    Fake Giveaways and Rug Pulls

    Fake giveaways remain popular since they appear simple and attractive. Messages often promise that anyone who sends cryptocurrency will receive double the amount back. No legitimate company or well-known crypto project follows this practice. Once the payment reaches the scammer, the money disappears forever. Another serious threat is the rug pull. Developers launch a new cryptocurrency project, attract investors through heavy promotion, and encourage large investments. After enough money enters the project, the creators sell their holdings or remove the project’s funds, which causes the token price to collapse. Research about the development team, project history, and smart contract audits can reduce the risk of such fraud.

    Pump-and-Dump Schemes

    Pump-and-dump schemes typically target thinly traded cryptocurrencies. In this manipulation scheme, promoters encourage followers to buy the same cryptocurrency, quickly driving up its price. Once the price rises sufficiently, the promoters quickly get rid of their cryptocurrency. The price goes down rapidly and the investors who bought the coin late suffer huge losses. These schemes usually imply some hidden trading groups and guaranteed profits. However, responsible investment practices still outperform the hype.

    Government Impersonation and Bitcoin ATM Fraud

    Criminals pose as the police, tax offices, courts, or utility companies. The trick works by making people panic over fake debts. Those targeted by the scam usually receive a prompt to deposit cash into a Bitcoin ATM. Since the transfer made with cryptocurrency is irreversible, the money cannot be retrieved. Legitimate government authorities do not ask for payment via cryptocurrency or Bitcoin ATMs.

    Seed Phrase Theft and Basic Safety

    The recovery phrase, also called the seed phrase, protects access to a cryptocurrency wallet. Anyone who obtains this phrase or the private key gains complete control over the stored funds. No legitimate wallet provider, crypto exchange, or customer support representative asks for this information. The safest approach includes private storage of recovery phrases, strong passwords, two-factor authentication, and hardware wallets for large crypto holdings. Careful checks before every transaction also reduce the chance of costly mistakes.

    Why This Matters

    Unmasking malicious digital asset operations shifts baseline defense into practical, highly proactive wallet management. Recognizing behavioral tricks like social manipulation and fake interfaces protects your capital from irreversible blockchain theft before fraudulent transactions occur.

    Final Thoughts

    Cryptocurrency offers many opportunities, but it also attracts skilled criminals who rely on deception instead of technology. Every investment deserves careful research before money changes hands. Strong security habits, independent verification, and a cautious mindset remain the best defense against crypto fraud.

    Frequently Asked Questions

    1. What is the most common cryptocurrency scam?

    Pig butchering scams, phishing attacks, and fake investment platforms are among the most common crypto frauds today.

    2. How can I tell if a crypto investment platform is fake?

    Check company registration, reviews, official websites, and avoid platforms promising guaranteed or unusually high returns.

    3. Should I ever share my wallet’s seed phrase?

    No. Your seed phrase should never be shared with anyone, including people claiming to be customer support.

    4. Are cryptocurrency transactions reversible?

    No. Most blockchain transactions are irreversible, making it critical to verify recipient addresses before sending funds.

    5. What’s the best way to protect my cryptocurrency?

    Use strong passwords, enable two-factor authentication, store large holdings in a hardware wallet, and verify every investment opportunity before transferring funds.

  • India Expands Scrutiny to Telegram and Signal Over Username Feature Security Risks

    India Expands Scrutiny to Telegram and Signal Over Username Feature Security Risks

    The Indian government has intensified its oversight of messaging platforms, extending its scrutiny to Telegram and Signal after raising concerns about WhatsApp’s planned username feature. The Ministry of Electronics and Information Technology (MeitY) has sent formal notices to both Telegram and Signal, requesting detailed information on how their username features operate and what safeguards are in place to prevent fraud, impersonation, and misuse.

    Why the Government is Concerned

    Username features allow users to communicate without revealing their mobile phone numbers. While this enhances privacy, it also reduces traceability and makes it easier for fraudsters to create fake identities. The government’s primary worry is impersonation of public figures, government officials, banks, and trusted institutions. Officials are also alarmed by the potential rise in phishing, online fraud, and so-called “digital arrest” scams, which have become a growing cybercrime threat in India.

    Earlier, MeitY had asked Meta to delay the launch of WhatsApp’s username feature in India, citing security concerns. The ministry gave WhatsApp a three-day deadline to provide information on its security measures and to refrain from introducing the feature until consultations are complete. India is WhatsApp’s largest market, with over 500 million users, making any new feature a major regulatory concern.

    Major Security Risks

    • Reduced traceability: Anonymity makes it harder for law enforcement to track cybercriminals who hide their phone numbers.
    • Increased impersonation risks: Usernames can mimic those of government agencies, celebrities, or financial institutions.
    • Facilitation of digital arrest scams: Fraudsters can contact users without revealing phone numbers.
    • Phishing attacks: Fake profiles can send harmful links or fraudulent messages at scale.
    • Undermined SIM identity association: Reduced traceability weakens the link between SIM identity and messaging activity.

    WhatsApp’s Safeguards

    WhatsApp has stated that usernames will be used for public accounts, government bodies, celebrities, and verified Meta accounts. It has also proposed an optional “Username Key” feature, requiring a four-digit number along with the username before unknown contacts can reach the user.

    The government will review responses from WhatsApp, Telegram, and Signal before taking any action under Indian IT laws.