Until recently, the only way to start a WhatsApp chat with a stranger was to know their phone number. This is changing.

Back in June 2026, WhatsApp opened username reservations and is rolling the feature out country by country through the rest of this year.

Usernames are an optional feature that allows you to create a unique identifier, for example @June123, to ensure that your phone number is kept private. In essence, with a username, your phone number will not be visible when you message or call anyone who doesn’t already have it saved in their contacts. Instead of giving people your phone number, you can simply give them your username to let them contact you on WhatsApp.

In many ways, WhatsApp usernames are a real privacy upgrade, however, they are also the newest place for brand and executive impersonation to grow and we will explain how later in this article. For now, however, if you work in security, legal, or brand protection, this is the moment to act, not after the feature has been released everywhere.

Most people outside security circles haven’t thought about what this means. A username is a new identity layer, and every new identity layer we have seen, from domains to social handles to app store listings, has been squatted, spoofed, and abused within months of its launch. Impersonation is already one of the fastest growing fraud tactics online. WhatsApp usernames have just given it another door to open.

Here is what changed, where risks may emerge, and what organizations can do to prepare.

What Changed: How WhatsApp Usernames Work

WhatsApp now lets people reserve a unique handle and share it instead of their phone number. Here are some of the basic facts around it according to TechCrunch and Business Standard:

• Reservations for usernames officially opened June 29, 2026. The full feature rolls out in phases later this year, and timing varies country by country.
• Handles are 3 to 35 characters, unique across all of WhatsApp. First come, first served.
• Reservations can only be made within the app itself, under Settings > Account > Username.
• There is no public directory or search. Someone needs your exact and unique username to message you for the first time.
• An optional username key adds a second code people must know before they can reach you.
• Obvious famous usernames have already been reserved. In fact, WhatsApp says it has reserved usernames for top celebrities, VIPs, and organizations, and businesses and creators can claim the handle they already use on Facebook or Instagram.
• A phone number is still required to create an account. Usernames sit on top of it; they don’t replace it.

WhatsApp has more than 3 billion users. That scale is exactly why this subject needs attention.

The Good News: A Genuine Privacy Win

Let’s give credit where it’s due. Decoupling contact discovery from phone numbers makes it much harder to mass enumerate WhatsApp accounts.

Why that matters: in November 2025, researchers from the University of Vienna and SBA Research showed they could query WhatsApp’s contact discovery at more than 100 million phone numbers per hour, confirming over 3.5 billion accounts across 245 countries, according to the University of Vienna. WhatsApp has since fixed the issue.

The researchers also found that roughly half of the phone numbers exposed in the 2021 Facebook data scrape were still tied to active WhatsApp accounts, according to SecurityWeek.

Because phone numbers can remain active for years, reducing unnecessary sharing may limit some opportunities for abuse. It does not, however, replace other account security measures.

The Problem: A New Layer for Brand and Executive Impersonation

From a defender’s point of view, usernames open a brand new impersonation surface. A phone number told you very little about who was on the other end. A username looks like an identity, and people trust what looks official.

It’s a fact that the reserved name lists won’t stop lookalikes. WhatsApp protecting famous names is helpful, but it only covers exact matches for a small group. It does nothing against typosquatting or lookalike handles, the same tricks that have worked on domains for decades.

Think acme.support, acme_billing, acmeofficial for a mid market executive nobody put on a VIP list.

This isn’t hypothetical. Just two weeks after the reservations opened, TechCrunch performed a test that found variants of actors, business executives and politicians to be having issues already of people taking their name handles.

Binance founder Changpeng Zhao said on X that he couldn’t reserve “cz_binance,” the handle he already uses on that platform. India’s IT ministry sent Meta a formal notice warning the feature could increase fraud, phishing, and impersonation, and asked WhatsApp to hold the rollout until those concerns were addressed.

The Reservation Window is Itself a Phishing Hook

The reservation process may also provide an opportunity for phishing. Scammers could exploit the urgency of securing a name by circulating fake instructions or claiming that a preferred username is about to be taken.

Security teams should watch for tactics such as:

• Fake reservation pages or lookalike apps designed to collect phone numbers or verification codes
• Messages falsely claiming that someone is attempting to claim a username, or that a reservation will expire soon
• Suspicious domains using WhatsApp-related terms to imitate an official registration process

Users should verify any username-related instructions through WhatsApp’s official app or published help resources rather than following unsolicited links.

This is the same type of trust abuse seen in many online phishing attacks, where attackers use a familiar brand and a sense of urgency to push users toward a fraudulent action.

The Phone Number Still Anchors the Account: SIM Swapping Hasn’t Gone Away

A username changes how people find you. It doesn’t change what controls your account. The phone number is still the anchor, which means SIM swapping remains the main route to a WhatsApp account takeover.

In a SIM swap, an attacker convinces a mobile carrier to move your number to a SIM they control. They receive your verification codes and can register your WhatsApp on their device.

The FBI’s Internet Crime Complaint Center logged 982 SIM swap complaints and nearly $26 million in reported losses in 2024, according to the FBI IC3 2024 report. Those are only the cases victims reported to one US portal.

The same logic applies to code theft. Kaspersky has documented WhatsApp scams that trick people into typing their login code on a fake voting site, handing attackers full control of the account, as reported by Malay Mail.

A hijacked executive account with a trusted username is a far more convincing impersonation than any lookalike.

This is also why external cybersecurity needs to extend beyond a company’s own network. The identity, domain, account, or phishing asset used in an attack may exist entirely outside systems the organization controls.

Red Flags to Watch for on WhatsApp

Share these with employees, customers, and anyone who might get a message “from” your company or leadership:

• A message from a username you’ve never seen claiming to be your CEO, finance team, or support desk
• Handles that are almost right, with an extra period, underscore, or words like official, support, or help
• Urgent requests for payments, gift cards, credentials, or moving the conversation off company channels
• Requests for a six digit WhatsApp code. WhatsApp never asks for it through a message or a link
• Links promising to reserve, verify, or protect your username outside the app
• “I changed my number” messages from someone you know, which are a classic setup for account takeover scams

The simplest rule: a username is not proof of identity. Verify through a channel you already trust.

What Organizations Need to Do Next

WhatsApp usernames offer meaningful privacy benefits, but they also introduce another identity that organizations may need to protect.

Review the availability of official handles, strengthen account security, educate employees about impersonation, and establish a process for identifying and reporting suspicious lookalikes.

As the rollout develops, security and brand protection teams should reassess how WhatsApp fits into their monitoring and response workflows.

The priority is not to treat every unfamiliar username as malicious, but to make sure a credible-looking handle is never mistaken for verified identity.

For organizations dealing with impersonation across messaging, social media, domains, and other external channels, online brand protection can help connect those risks instead of treating each fake identity as an isolated problem.

Brands should also consider whether fake messaging identities are part of wider social media impersonation and scam activity, especially when the same identity appears across multiple platforms.

Have you already seen VIP or brand impersonation on WhatsApp? We’d like to hear what it looked like.