One can reasonably say that in the year 2026, anyone is only three degrees away from a celebrity, and only one degree away from a cyber scammer. The pervasive embedding of social media in our lives is the primary reason for this phenomenon. But what is social media? We offer a very simple and intuitive definition – Any tool, system or protocol that allows people to communicate with each other and exchange information is social media.
The medium itself is irrelevant, because even a newspaper with a ‘letter to the editor’ satisfies the above definition. But modern social media feels different not because it is digital, but because it allows “discovering” others much easier than columnists such as us. One becomes a celebrity on social media only when others discover the celebrity, and social media solves this problem through algorithmic filters and “likeness and closeness of interests and values” via recommendations on whom to follow, based on user actions (e.g. Likes, Re-tweets, Posts, Comments).
Human beings are just a noisy detail for the algorithm, and hence an account on any social media platform would be a random username in the initial days. The side effect of this was full anonymity for those who wanted it, and, in that aspect, is no different than an email address on popular domains (e.g. gmail, outlook, yahoo). This continued even when phone numbers were used as usernames by messaging products like WhatsApp. Given that in many jurisdictions, getting a SIM card and a phone number is possible without elaborate ID checks, phone numbers are still considered semi-anonymous identifiers, and not real person identifiers.
The mass adoption of social media tools, which, from their inception had anonymity baked in the design, led to the rise of scammers. Connecting with people via advertisements is no different than celebrities posting content to optimize the algorithmic filters. Given that opting out of algorithms is not possible, the only defence against the scammers is cultivating critical thinking and limiting direct contact.
Another way to understand this evolution is to look at how digital products have progressively reduced unnecessary information disclosure. Modern payment systems increasingly replace visible card numbers with tokens. Email providers now offer masked email addresses. Browsers conceal many technical identifiers that websites previously received by default. None of these changes eliminated accountability. They merely reduced the amount of information routinely exposed during ordinary interactions. Usernames follow the same engineering principle.
Limiting direct contact is already possible with normal mobile telephony. Both popular OS (Android, Apple) allow numbers not in the contact address book to automatically be silenced. However, scams have continued unabated because of businesses collecting phone numbers, making them default usernames and using communication channels to send both transaction updates and marketing spam.
That design decision solved discoverability at internet scale, but also normalised exposing a persistent personal identifier in situations where it was never strictly necessary.
Even interventions such as TRAI’s Do Not Disturb register or Calling Name Presentation do not solve the incoming call problems – At the most they just provide a signal (e.g. No name, Marketing Spam) and push the decision making to the receiver. This is why an often asked for feature in WhatsApp or any other communication product is – Prevent incoming calls and/or messages from accounts one has not interacted with before.
Scammers typically procure phone numbers from the market (either from the businesses that collect or from data traders) and use automated tools to send messages to them because discovery via phone numbers is the default in most products. This is where the product design of semi-anonymous usernames comes into picture. Firstly, one need not reveal one’s phone number (say in a group of strangers discussing a health issue). And then set a PIN, that will prevent anyone in that group directly messaging you. Hence, the feature allows both engagement with strangers on shared interests, but without personal identifying exposure.
Naturally this poses the question to law enforcement agencies (LEA) – What if the shared interest is planning a murder, selling drugs or access to a NEET test paper? Both Telegram and WhatsApp already provide significant data to LEAs on demand including broadcast channels, group memberships and other meta-data including IP Address, phone number, last login time and first-time login time. Thus, decoding a username to a phone number is a solved problem, as much more sensitive data is provided on demand.
The only extra work involved is to ask for the mapping, after identifying a problematic channel / group, where this was automatically available before the username feature rolled out. In essence, the pause order for the username feature has a foundational premise – Always prioritize ease of use for law enforcement even if it means not providing tools for common people to defend themselves against scammers.
This episode also illustrates why India now requires a more technologically informed philosophy of digital policymaking. Regulators cannot realistically evaluate every emerging product feature individually. They require foundational understanding of digital technology and the evolutionary path a product took and root regulatory philosophy on enduring principles capable of governing technologies that have not yet been invented.
India rightly aspires to become a technology powerhouse and a global leader in digital technologies. Those ambitions require an equally sophisticated philosophy of digital regulation. Technological leadership is ultimately determined not only by the quality of innovation a nation produces, but equally by the wisdom, proportionality and predictability with which it governs that innovation.
.png)
