Meta has been gradually rolling out unique usernames for its messaging service WhatsApp since late June 2026, but is facing significant pushback. In India, the government halted the rollout over fears of a massive surge in phishing and so-called “digital arrest” scams. The local IT ministry is currently reviewing a response submitted by WhatsApp regarding its security measures.
Privacy Without a Phone Number
Until now, the service strictly required a visible phone number. With the new @handles, around 3 billion users worldwide are intended to message each other without exposing their private phone numbers. According to WhatsApp Head of Product Alice Newton-Rex, this step is meant to give users greater control over their personal data.
Reserving usernames is handled exclusively via the mobile app settings on a first-come, first-served basis—web and desktop clients are not supported for this process. A username must be between 3 and 35 characters long, start with a letter, and contain at least one letter. Purely numeric combinations, special characters, and handles starting with “www” or ending with web domains are blocked. There is no public user search: for initial contact, users must know the exact handle or a direct link. Existing contacts will continue to see the phone number.
Security Concerns and Fraud Risks
Despite the privacy benefits, security experts warn of new attack vectors. Former investigator Rav Wilding highlights the risk of impersonation—the deliberate falsification of identity. Cybercriminals could create deceptively convincing profiles using slight character variations, such as replacing the letter “I” with the numeral “1” or inserting underscores.
In India, the government primarily feared a surge in phishing attacks and “digital arrest” scam schemes, prompting it to halt the rollout. Other countries have also voiced reservations: in Somalia, Communications Minister Ahmed Osman Dirie warned of risks to the heavily utilized mobile money ecosystem, arguing that usernames are harder to trace. Additionally, Kenyan security expert George Musamali warned about the obscuring of perpetrator identities.
Threats to Businesses and Brands
Beyond government authorities, intellectual property law firms such as Plasseraud IP point out risks regarding the impersonation of brands, companies, or executives. WhatsApp has announced mechanisms to protect names reserved for high-ranking officials, celebrities, and government agencies.
Those who rely on WhatsApp notifications or alternative clients—such as desktop solutions like ZapFast or messaging automations via Home Assistant—will need to adapt to the transition in the medium term. Users in Germany should critically examine incoming requests from unfamiliar usernames and scrutinize spelling once the feature is enabled.
Sources: Borncity.com
