WhatsApp usernames: a privacy shield with sharp edges
WhatsApp usernames are a new feature that lets people connect and start conversations without sharing their phone numbers, replacing visible numbers with unique identifiers to limit exposure in first-time chats, group interactions, and business conversations.
That sounds like progress, and in many ways it is. Phone number privacy has long been WhatsApp’s weakest link: anyone who gets your number can message you, add you to groups, or share it further. By allowing first-time contacts to see a username instead of a phone number, WhatsApp reduces the surface for spam, harassment, and unwanted contact. Users can choose a unique handle or rely on a built-in generator, and people or organisations already active on other Meta platforms can align their identity by claiming matching Instagram or Facebook usernames. In theory, this is a cleaner, safer way to meet new contacts. In practice, it shifts risk rather than removing it.
How the feature works—and who it affects next
WhatsApp usernames are not fully live yet, but the foundations are in place. The company has announced that the feature was recently introduced and will roll out gradually over the coming months, in global phases. For now, users can only reserve their usernames via the latest app version by going to Settings > Account > Username. As WhatsApp itself states, “The ability to use a username is not yet live and will roll out slowly later this year.”
When the rollout hits your account, the flow will be simple: you still register and log in with a phone number, but when someone contacts you for the first time, they see your chosen username instead of that number—if you have set one. This is meant for first-time connections and group participation without revealing phone details. There will be no public directory or suggestion list; people must know your exact username to message you. That design helps limit random spam, but it doesn’t end the bigger story: impersonation and fraud.
Impersonation risks: a new attack surface by design
The central security worry is not about encryption or message content—it is about who you think you are talking to. Government regulators are already reviewing the username feature because it could be misused for impersonation and online fraud. Officials fear that usernames could make it easier for scammers to hide their identities and impersonate people, companies, or government agencies, while staying shielded behind anonymous identities.
Username-based contact discovery is a classic double-edged sword. On one hand, it protects phone number privacy by letting people discover each other without revealing their phone number right away. On the other hand, it creates a new attack surface: scammers can craft lookalike usernames, pretend to be well-known organisations, and approach victims as seemingly safe “handles” instead of suspicious unknown numbers. In other words, usernames move WhatsApp closer to the same social-engineering problems seen on older handle-based platforms—problems that threat actors already know how to exploit.
Built-in fraud protection: necessary, but not sufficient
WhatsApp argues that it has designed fraud protection into the feature from the start. The platform is reserving certain usernames linked to public figures, government entities, celebrities, and verified Meta accounts so they can only be claimed by their legitimate owners, and it is also holding lookalike derivatives of known names. The company stresses that “protections are already built in, including reserved usernames for public figures, government entities, celebrities, and verified Meta accounts.”
Beyond name reservation, WhatsApp says there will be no searchable username directory; people must know your exact username to message you. The app will cap how many new users any account can contact, block repeated guessing of usernames, and use automated systems to flag impersonation or other suspicious activity. It will also show extra context when a username messages you for the first time—for example, whether it is a new account, already in your contacts, in a shared group, or from another country. These safeguards are welcome, but they mainly raise the bar; they do not eliminate impersonation risks for ordinary users who cannot rely on reserved or verified names.
What users should do now—and what regulators should demand
Even before usernames go fully live, users have decisions to make. You can already reserve a preferred username through Settings > Account > Username in the latest app version. Reserving early helps protect your identity from opportunistic squatters once the feature arrives. However, you should choose a handle that does not reveal sensitive personal information, since usernames may circulate more widely than phone numbers in some contexts.
Until the phased rollout completes later this year, the feature remains unavailable for everyday messaging: it is in reservation-only mode and will be turned on gradually for users worldwide. In the meantime, treat any future username contact with the same caution you would an unexpected call from an unknown number: verify through a second channel, distrust “urgent” financial or account requests, and pay attention to the context cues WhatsApp plans to display. Regulators are right to demand clear answers on impersonation and fraud, because privacy gains mean little if people cannot trust who is behind the username. The promise of phone number privacy should not become a shortcut for scammers.
