WhatsApp is finally letting you hide your phone number behind a custom username. While it's a massive win for privacy, cybersecurity experts warn it could unleash a wave of identity scams. Here is what you need to know.
What’s changing and why?
If you've ever joined a neighbourhood society group, a school parents' chat or a public community on WhatsApp, you've probably felt that slight cringe knowing that absolute strangers can see your private mobile number.
For over a decade, your phone number was your WhatsApp identity. That is finally changing.
According to data tracked by tech insider WABetaInfo, Meta is rolling out custom alphanumeric usernames (think @YourNameHere).
The company officially opened global reservations for usernames to give its three billion users a head start on securing their preferred handles.
The logic behind the move is simple: Privacy.
Reports in Frugal Testing and Moneycontrol note that keeping phone numbers out in the open leaves everyday users vulnerable to spam syndicates, telemarketers and scams like SIM-swapping.
By switching to usernames, WhatsApp wants to give you a shield so you can chat freely without giving away a direct line to your personal life.
The names will be 3 to 35 characters long and there won’t be a public directory where people can just scroll and find you. To message you, someone will need your exact handle or a QR code.
The good news: Better privacy
The biggest pro here is obvious: Control.
You can now sell an old couch on a digital marketplace or coordinate a temporary project with a stranger without handing over your actual digits. Once the interaction is done, you can walk away without worrying about them saving your number.
It also means public forums become a lot safer for women and vulnerable users who routinely face unsolicited calls or harassment just for being part of a large group chat.
The catch: A new breeding ground for scammers
But let's look at the flip side, because cybersecurity experts are genuinely worried.
Stripping away a physical, registered identifier like a phone number makes it incredibly easy to hide.
Writing for The National News, security analysts pointed out that the risk of impersonation is about to skyrocket.
It takes seconds for a scammer to register a handle that looks nearly identical to your local bank, your internet provider or even your boss. Because everything happens neatly inside a WhatsApp chat window, it is incredibly easy to fall for a fake account.
Then there is the headache of ‘name squatting’ -- people snapping up popular business names or common handles purely to sell them back for an exorbitant fee or use them for phishing.
Government authorities are already on high alert; The Economic Times reports that Indian officials are worried this anonymity will throw a massive wrench in the process of tracking down digital fraudsters.
The fine print: Loopholes and traps to watch out for
Before you assume your identity is completely safe, you need to understand that this update is a forward-looking shield, not a magical eraser.
There are a few critical gaps in the design that Meta isn't loudly advertising.
Existing groups leave you exposed
The fine print here is literal. WhatsApp states that usernames only hide your number when someone contacts you ‘for the first time’.
If you are already in a housing society group, office chat or school circle, your phone number remains visible to those members.
Creating a username today will not retroactively scrub your digits from their screens. Furthermore, if a stranger is in a mutual group chat with you, they can simply tap your profile and see your number.
The username only protects you in new, one-on-one threads.
The typo-squatting trap
Scammers can't steal an exact business username but they can easily exploit phonetic lookalikes.
While a brand might own @BharatGas, a fraudster can easily register @BhaaratGas or @BharathGas.
Because we skim text quickly on mobile screens, these subtle spelling variations are bound to catch unsuspecting users off guard.
The Meta privacy compromise
When you set up your handle, the app will suggest linking your WhatsApp to your Meta account centre to automatically import your Instagram or Facebook name.
Don't do it!
Linking them bridges the gap between your private chat network and your public social media ad profile.
For true privacy, type in a completely unique handle manually.
The block verification loophole (and Meta's fix)
Right before launching this feature, WhatsApp had to plug a bizarre encryption loophole. WABetaInfo discovered that if someone wanted to verify if you had blocked them, they didn't need your phone number.
They could simply open your chat window, head to contact info and attempt an automatic encryption verification check.
If the check failed, it was a dead giveaway that they were blocked.
To protect user privacy alongside the handle rollout, WhatsApp quietly launched a server-side patch: The automatic verification check now falsely ‘passes’ even if you have blocked that person, keeping your status hidden.
The professional angle: A new 'trust tax' for small businesses?
If you use WhatsApp to run a boutique home business, freelance or coordinate with clients, this update is going to fundamentally change how you build trust.
Meta has expanded paid verification subscription plans for businesses in India.
Subscribing is the only way a business can get an official blue checkmark next to its username.
But tech leaders are already calling this out as a trap. Critics point out that by replacing registered phone numbers with easy-to-fake text handles, Meta is creating an identity loop for scammers. Unverified, similar-sounding handles will inevitably pop up to trick customers.
This forces small, independent businesses into a corner: Pay Meta a monthly fee for a blue checkmark or risk losing your customers' trust to a clone account.
What if you don't want to pay for a blue check?
You do not have to give in to Meta’s monetisation squeeze.
If you are an independent creator or a small business that wants to stay unverified but safe, you have two defensive options:
Claim your identity early: WhatsApp is allowing businesses to sync and reserve their usernames directly based on their existing, established Instagram or Facebook handles.
Do this immediately so a squatter cannot steal your brand's name.
Lean on the 'Contact Book' safeguard: The impersonation risk mostly applies to new customers finding you for the first time via your username handle.
If a customer already has your phone number saved or has chatted with you before, your identity mapping is safely locked in Meta’s background registry.
Turn on your 4-digit Username Key PIN and share it only on your official website or social media bio so new clients can safely cross the digital threshold into your inbox.
Step-by-step: How to claim your name on your phone
Because there are over three billion users on the platform, you'll want to reserve your unique handle before someone else snatches it.
1. Update your app: Go to the Google Play Store or Apple App Store and make sure WhatsApp is updated to the absolute latest version.
2. Navigate to account settings: This can be done on your mobile only.
Open WhatsApp on your phone. On Android, tap the three dots in the top right, then Settings.
On iOS (iPhone), tap the ‘You’ icon in the bottom right corner. From there, select Account.
3. Claim your handle: Choose your unique ID.
Tap Username (or 'Reserve Username' if it is still rolling out to your specific account). Type in your preferred handle. If it's taken, WhatsApp will suggest variations.
You can also link your WhatsApp to Meta's Account Center to automatically pull and reserve your existing Instagram or Facebook handle.
Tap Save or Done.
4. Turn on your username key: This is a crucial safety layer.
While still in the Username menu, tap Contact me by username. Change the setting from Everyone to People who know my key.
WhatsApp will generate a unique 4-digit PIN for you. Save it.
Now, anyone trying to reach your username for the first time will need this PIN to open a chat.
Will this change reflect on your desktop WhatsApp?
Yes, but with an important catch. According to reports by PCMag and TechRadar, the option to create, edit or reserve a username is strictly locked to your primary mobile phone.
You cannot set up your handle from WhatsApp Web or the Mac/Windows desktop applications.
However, once you have successfully claimed your username and set up your 4-digit PIN on your phone, the change will automatically sync across all your linked devices.
Your hidden phone number settings, your username profile display and the incoming chat restrictions managed by your Username Key will work flawlessly on your desktop just as they do on your mobile.
