X's 'Numbers' Feature Does What Got WhatsApp Paused in India

Open XChat today and the app will offer to generate you an eight-digit code that strangers can use to message or call you, no phone number required. Three months ago, India's IT ministry gave WhatsApp just two days to explain why it shouldn't face regulatory action for building almost exactly the same thing.

That gap — between what X has shipped quietly and what WhatsApp got hauled up for — is the real story here, and it says more about how India regulates Big Tech than about either feature on its own.

What X Numbers Actually Does

X Numbers rolled out in late September inside XChat, the messaging layer X has been rebuilding since Elon Musk took over the platform. The idea is simple: instead of handing someone your phone number to message or call them, you hand out a private eight-digit code. The other person doesn't need to follow you, and you don't need to follow them back — the code alone opens the door.

It's the same pitch messaging apps have been making for a while now: let people connect without exposing the one piece of contact information tied to their real identity, their SIM card, their bank KYC, everything.

The WhatsApp Precedent

That pitch is precisely what got WhatsApp into trouble in India back in July. When Meta announced it was rolling out usernames globally, India included, the Ministry of Electronics and Information Technology (MeitY) sent a notice within about 48 hours, ordering the company to pause the India rollout until further consultation and demanding a detailed explanation inside three days.

The feature, MeitY warned, could "materially increase the incidence of online fraud, phishing, digital arrest scams and impersonation attacks."

A digital arrest scam — for readers who haven't run into the term — is a uniquely Indian con where fraudsters impersonate police or government officials over a video call and convince victims they're under investigation, pressuring them into transferring money to avoid "arrest." It's become one of the fastest-growing fraud categories in the country, and MeitY's worry was straightforward: a username system that lets anyone message you while hiding the number tied to their identity makes it easier to impersonate a bank, a government office, or a cop.

Meta's response was that the feature wasn't actually live in India yet and that it had already pre-reserved usernames resembling public figures, banks, and government bodies to block obvious impersonation attempts. MeitY wasn't the only one watching closely — it reportedly sent similar notices to Telegram and Signal the following week, since both already let people message by username rather than number.

Same Exposure, No Notice Yet

X Numbers does the identical job WhatsApp's usernames were meant to do, and by X's own admission, carries a similar risk. The in-app prompt reportedly warns users that anyone with the code can message or call them, bypassing closed inboxes, and that those messages skip the message-request screen altogether — the same exposure path MeitY flagged for usernames. X's official line is that the code "is not a phone number" and doesn't replace the number tied to the account, which is true in a narrow technical sense but doesn't change what the code lets a stranger do.

As of now, there's no public record of MeitY sending X a similar notice. Whether that's because the feature hasn't reached the ministry's radar yet, because X has fewer users in India than WhatsApp, or because enforcement here tends to be complaint-driven rather than systematic, isn't clear from anything on record.

The Internet Freedom Foundation has separately argued that MeitY doesn't actually have clear legal authority under the IT Act or the 2021 intermediary rules to order a platform to pause or withdraw a specific feature in the first place — the kind of due-diligence obligations those rules spell out for "intermediaries" (companies like Meta and X that host third-party content without directly creating it) don't obviously stretch that far. If that's right, the WhatsApp notice may have worked more through pressure than through a clearly citable legal power.

A quick comparison of what's actually on the table:

• WhatsApp usernames: announced July 2026, paused in India within two days of the announcement, still not live for Indian users
• Telegram and Signal: received similar MeitY notices the same week, since username-based messaging was already a feature on both
• X Numbers: live since late September, no reported notice so far

Why This Matters Beyond X and WhatsApp

For Indian users, the practical risk isn't which company's logo is on the app — it's the feature itself. A code or username that lets a stranger reach you without revealing their own number is equally exploitable whether it ships from Meta, X, or the next messaging app chasing the same privacy pitch. If digital arrest scams and phishing are the real worry, as MeitY said they were, the rule needs to track what a feature does, not which company drew attention first.

Right now, India doesn't have a published, general standard for this — just a notice to one company and silence toward another doing the same thing. That's worth watching as more apps, Indian and foreign alike, build their own version of the same convenience.