WhatsApp Usernames: Privacy Win, Fraud Risk Or Both?

In late June 2026, Meta officially launched one of the most significant privacy overhauls in WhatsApp's history, the ability to communicate using unique usernames rather than phone numbers. For a platform serving over three billion users globally, this is an architectural shift that fundamentally changes how people identify themselves on the world's most popular messaging service. At present, the feature is optional, meaning users who prefer the traditional phone number-based system can continue using WhatsApp as before. The feature will be rolled out gradually over the coming months and users will be notified when their username functionality is activated.

The WhatsApp username replaces the need to share a personal phone number when initiating new conversations. Once enabled, a user's phone number remains entirely hidden from new contacts, they will only see the username.

Privacy-fraud trade-off

The privacy benefits are tangible. By decoupling the phone number from the user-facing identifier, the feature reduces the attack surface for several well-documented WhatsApp scams. On WhatsApp, fraudsters lean heavily on social engineering that exploits the trust embedded in a contact's profile name and photo, with the most damaging tactic being six-digit verification-code theft, where an attacker fakes urgency and tricks the victim into revealing their one-time login code, thereby seizing the account. Other prevalent schemes include "friend or family in need" money requests and "pig-butchering" investment lures. Many of these scams begin with a fraudster obtaining or targeting a victim's phone number, removing the number from the equation should reduce the incidence of SIM-swap attacks and phone-number harvesting. However, there are concerns that the feature may materially increase the incidence of online fraud, phishing and digital scams, and may facilitate impersonation of public figures, authorities and government agencies, by permitting the adoption of usernames closely resembling those of genuine people and institutions.

Profile cloning and impersonation are already significant challenges across Meta's platforms and may become more prevalent if usernames are easier to imitate,,spoof or misrepresent than phone numbers.

Meta and WhatApp respond

WhatsApp has responded by noting that it has "multiple layers of defense in place" and has reserved high-profile names of public figures, government entities and celebrities. The company emphasised that "other users need to know the exact username to message you," that it will "limit how many new people an account can contact" and that it has "systems to detect and remove activity showing common impersonation and abuse patterns."

Messaging platforms as criminal enablers

These concerns are not merely theoretical. Other messaging platforms, in particular, Telegram has effectively become "the new dark web", linking criminals and enabling illegal activity on a mass scale. Criminals have rapidly adopted the platform to post links on channels that connect to dark-web forums through deep-web links, making it difficult for authorities to track criminal conduct.

Could WhatsApp's username feature inadvertently make the platform more attractive to criminal actors who currently favour Telegram for its anonymity? Telegram's appeal to criminal actors derives in part from its username-based system, its cloud-based architecture that permits the transmission of large volumes of content, and its perceived resistance to government requests for user data. If WhatsApp introduces a comparable level of anonymity through usernames whilst retaining its larger user base and end-to-end encryption, it could become an attractive alternative for actors who want anonymity combined with broader reach. However, there is a crucial distinction. WhatsApp still requires a phone number at registration, which preserves an underlying identity anchor that Telegram does not consistently require. The phone number therefore remains in Meta's records. Whether this distinction remains meaningful depends on how robustly Meta enforces identity verification at the registration stage and how readily it cooperates with law enforcement.

Identifying users

Phone numbers have historically served as a critical anchor point in digital forensic investigations. A phone number is tied to a SIM card, which in most jurisdictions requires some form of identity verification at the point of acquisition. Investigators can use phone numbers to establish identity through telecommunications service providers, link suspects to specific devices and corroborate timelines. If WhatsApp communications increasingly occur between usernames with no phone number exchanged, the link between a digital interaction and a real-world person becomes more difficult to resolve. Forensic investigators will need to develop new attribution frameworks that do not rely on a phone number as the primary identifier, focusing instead on alternative metadata including device identifiers, IP address logs, session tokens, and any account-creation records retained by Meta. This could reduce the ability of law enforcement agencies to trace suspects involved in cybercrime and financial scams.

The debate around WhatsApp's username feature highlights a tension that runs through every privacy innovation in the digital age: the same tools that protect ordinary users from surveillance and harassment can also be exploited by those with malicious intent.

For now, the username feature brings WhatsApp into line with Telegram and Signal, which have long offered username-based communication as a privacy standard. The question is whether WhatsApp can deliver the privacy without inheriting the problems.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.