WhatsApp has addressed some privacy concerns with the introduction of usernames, allowing users to remain anonymous while communicating.
The messaging platform, which has more than three billion users, aims to make it more difficult for bad actors to harvest numbers, contact people directly, or connect a WhatsApp account to other parts of a person’s identity.
But given the creativity and workarounds in the digital underworld, risks persist.
Eliad Kimhy, a senior security researcher at cyber security company Acronis, told The National: “It may reduce some types of abuse but it will not significantly reduce scamming overall. Scams follow attention, trust and scale, and WhatsApp has all three.”
“Scammers will adapt … we should expect more attempts to impersonate friends, brands, executives, customer support teams or public figures through convincing handles, profile images and social engineering.”
Beginner's guide
The latest WhatsApp update allows a username to be selected under the account menu in settings.
The app will inform you whether the chosen name, which can be up to 35 characters, is available. Specific usernames, such as high-profile individuals (“DonaldTrump” or “Jesus Christ”), are either unavailable or reserved for WhatsApp Business users, seen as a move to prevent spoofing or misuse of a persona.
An added layer of security is a username key, an optional code that requires a username and a key to contact someone for the first time.
Usernames will go live gradually on a market-by-market basis, with full introduction expected by September. People can also edit and switch usernames, provided they are still available.
“For a platform with three billion users, this isn’t a cosmetic update,” said Shruti Inani, a senior analyst at India-based investment platform LVX. “It’s a fundamental rewrite of how identity works on the world’s largest messaging app.”
For businesses in particular, it opens a “genuine” branding advantage, according to analysts at the Universal Business Council (UBC), an alliance of business leaders based in California.
“A clear, recognisable username gives a business a far more memorable presence in a customer's chat list than an unfamiliar phone number ever could,” the analysts said.
What took so long?
Why has WhatsApp's parent, Meta Platforms, taken this long to unveil the feature? The California-based social media giant has reportedly been testing the feature for years
For perspective, Signal, a smaller platform with an estimated 150 million users, has been offering this since 2022, while Telegram, another billion-user app that was once viewed as a threat to WhatsApp, has had the option in place since 2013. That was before Meta, then known as Facebook, had even bought WhatsApp for $19 billion. Meta's Instagram and Threads each have a similar mode, so certain cross-platform data is being shared.
WhatsApp's scale explains much of the delay in introducing a new global identity system across billions of active accounts, the UBC said.
That process included “preserving backward compatibility with existing conversations and business integrations, and required years of infrastructure work that smaller competitors never had to manage”, it said.
Hiding a phone number is good for user privacy, but at the same time it removes a traceable identifier and lowers the friction for impersonation and social engineering, the source of most messaging scams, said Daniel Kollberg, chief executive of Promon, an Oslo-based software development company.
“The takeaway for the industry is that platforms can no longer treat the phone number as a safety net,” he told The National. “The defences that matter now sit deeper: confirming the app hasn't been tampered with, that the device isn't compromised and that the behaviour behind a message is human rather than automated.
“In other words, you can lose the phone number without losing trust, provided deeper and stronger protective mechanisms sit behind it.”
The 'inevitable test'
Sending anonymous messages via WhatsApp isn't new, as there are third-party apps and online sites that already do so. Doing this natively – within the app itself – considerably reduces the risk of other threats, such as malware.
The real risk isn’t strangers randomly finding their way into your direct messages; it’s impersonation, Ms Inani noted.
“Anyone can register a username resembling a real person or brand. Your phone number doesn’t disappear; it’s still required to register and run the account,” she said.
“The timing matters, too. This roll-out comes as rival apps like Signal have gained users specifically by offering privacy-first features WhatsApp didn’t have. Meta is closing that gap directly.”
There might also be a question of WhatsApp becoming “less official”, given usernames can be created by anyone. Mr Kimhy argues this may not be the case, as “trust signals will need to evolve”.
For example, businesses, banks, government bodies and public figures, verified identities, clear account labelling and user awareness will become even more important, he said.
“The platform may become less phone-number-centric and more handle-based, but that does not make it less official or less trusted,” Mr Kimhy said.
“In short, usernames are a good privacy improvement, but they are not a scam-prevention silver bullet. They reduce one exposure point while creating a new identity layer that attackers will inevitably test.”
Andrei Skorobogatov, director of policy at The Hague-based Global Anti-Scam Alliance, said there are two “obvious” initial implications in the counterfraud space.
“Scammers may find it easier to obscure their country of origin when contacting individuals,” he said. “They will also find it easier to impersonate legitimate institutions – a protective registration mechanism for businesses will exist but we all know those can easily be circumnavigated with a credible story or other kind of lure.”
In any case, whether this will positively or negatively affect the ability of law enforcement to identify criminals by using registered telephone numbers remains to be seen.
“If it becomes significantly more difficult to identify a criminal in a crime report, then this will have a material negative impact on law enforcement's ability to investigate many frauds … I hope to see that there will be a username resolution capability for law enforcement and other trusted flaggers.”
