WhatsApp is introducing a username feature that allows users to connect without sharing their phone numbers, a move that security analysts and users warn could increase the risk of phishing and impersonation scams. By replacing the mandatory phone number requirement with a unique handle, the platform aims to increase privacy, but the shift creates a new vector for bad actors to spoof identities and target unsuspecting users through social engineering.
The feature, which has appeared as a “Reserve Username” notification for some users, fundamentally changes how identities are verified on the app. Traditionally, WhatsApp relied on a phone number as a unique identifier, which provided a layer of verification since SIM cards are tied to registered accounts. The introduction of usernames removes this tether, potentially allowing scammers to create handles that mimic official businesses, government agencies, or trusted individuals.
According to reports from various Indonesian tech outlets including Kompas and Liputan6, the primary concern is that usernames make it easier for phishers to cast a wider net. Without the need for a phone number to initiate a chat, attackers can more easily distribute malicious links or fraudulent requests to strangers who believe they are communicating with a verified entity.
How the WhatsApp Username Feature Works
The new system allows users to create a custom handle, similar to those found on Telegram or X (formerly Twitter). Once a username is set, other users can find and message the account by searching for that specific handle rather than needing to save a phone number into their device’s contact list. This is designed to protect the privacy of users who do not want to disclose their personal mobile number to acquaintances, clients, or the general public.
While the privacy benefit is clear for the user, the structural change introduces a vulnerability. In a phone-number-based system, a user can often verify a contact through other means or see if a number is registered in a specific region. Usernames are abstract; a handle like “@OfficialBankSupport” can be created by anyone if the platform does not implement strict verification or “blue check” authentication for all professional accounts.
Users who have seen the “Reserve Username” prompt are essentially being invited to claim their preferred handle before others do. This urgency often mirrors the tactics used in social engineering, though in this case, it is an official platform rollout. However, the ability to “squat” on usernames—claiming names of famous people or brands—is a known issue in social media that could lead to widespread impersonation on WhatsApp.
Phishing Risks and the Threat of Impersonation
Security experts highlight that the lack of a phone number requirement lowers the barrier to entry for scammers. Phishing typically involves deceiving a user into providing sensitive information, such as passwords or financial details. With usernames, a scammer can create a persona that looks legitimate and then send mass messages to targets.
The risk is amplified when combined with WhatsApp’s existing business tools. If a scammer uses a username that closely resembles a known company, they can trick users into clicking “spoofed” links that lead to fake login pages. Because the user is not seeing a random, unfamiliar phone number from a foreign country—which is often a red flag for scams—they may be more inclined to trust the interaction.
Furthermore, the “privacy” aspect of the feature works both ways. While it hides the user’s number from the recipient, it also hides the sender’s number from the victim. This anonymity makes it significantly harder for law enforcement or the users themselves to trace the origin of a fraudulent message back to a physical SIM card or a specific registered identity.
Comparing the Username Model to Traditional Phone Verification
The transition from a phone-centric identity to a username-centric identity represents a significant shift in the app’s security architecture. The following table outlines the primary differences in how these two systems impact user security and privacy.
| Feature | Phone Number System | Username System |
|---|---|---|
| Identity Verification | Tied to a physical SIM/Carrier | Abstract handle; easier to spoof |
| Privacy | Number is visible to contacts | Number can be hidden from others |
| Scam Detection | Foreign country codes act as red flags | Harder to detect origin of the sender |
| Account Discovery | Requires adding to contact list | Searchable via global handle |
Steps to Protect Your Account from Phishing
As WhatsApp rolls out these changes, users should adopt a more skeptical approach to incoming messages from unknown handles.
To mitigate the risks associated with the new username system, users should follow these guidelines:
- Verify Identities Independently: If a “friend” or “business” contacts you via a new username asking for money or data, verify their identity through a different communication channel (e.g., a phone call).
- Avoid Clicking Suspicious Links: Be wary of URLs that look slightly altered (e.g., “whatapp-support.com” instead of the official domain).
- Enable Two-Step Verification: This adds a PIN to your account, making it harder for hackers to hijack your session even if they gain access to your registration details.
- Report and Block: Use the built-in reporting tools to flag accounts that are impersonating brands or individuals.
The ability to block users remains the most effective tool against phishing. If a user receives a message from a handle they do not recognize, blocking the account immediately prevents the attacker from continuing the social engineering attempt.
What Happens Next
WhatsApp has not yet released a comprehensive timeline for the global rollout of the username feature to all users, nor has it detailed a specific verification system for “Official” usernames to prevent impersonation. Users should monitor their app updates for official notifications regarding account security settings and the “Reserve Username” prompt.
Do you think usernames make WhatsApp safer or more dangerous? Share your thoughts in the comments below and share this article with your contacts to help them stay alert.