Less than a week after WhatsApp began rolling out its long-awaited username feature, cybersecurity researchers are warning that the update could create new opportunities for impersonation, scams and identity fraud if users are not careful.
The feature, designed to let people connect without sharing their phone numbers, has been widely welcomed as a privacy improvement because instead of exchanging mobile numbers, users can create a unique username that can be shared with friends, businesses or communities.
However, security experts say the same feature that enhances privacy could also make it easier for cybercriminals to impersonate trusted individuals, brands and public figures.
New impersonation risks
Researchers have raised concerns that malicious actors may register usernames closely resembling those of legitimate users or organisations by making subtle changes that are difficult to spot.
For example, scammers could replace letters with similar-looking characters, add punctuation or insert extra letters to create usernames that appear authentic at first glance.
Victims may believe they are communicating with a trusted friend, business or public figure when they are actually interacting with a fraudster.
This technique, commonly known as username spoofing or lookalike impersonation, has long been a problem on social media platforms and messaging applications like Instagram and X, formerly Twitter.
Although WhatsApp's username system is expected to prevent duplicate names, experts note that visually similar usernames can still deceive users who do not verify profiles carefully.
Opportunity for scammers
Cybersecurity analysts warn that fraudsters may use fake usernames to launch phishing attacks, investment scams, fake customer support operations or romance scams.
Because WhatsApp is widely used for personal and business communication, impersonating a trusted contact could significantly increase the likelihood that victims will click malicious links, disclose sensitive information or send money.
Experts caution that criminals often move quickly whenever major technology platforms introduce new features, exploiting public unfamiliarity before users learn how to recognise potential scams.
Privacy benefits remain significant
Despite the concerns, researchers stress that usernames also represent an important step forward for privacy.
For years, users have had to share their phone numbers with strangers in order to chat on WhatsApp, exposing personal information that could later be abused.
Privacy advocates say the feature could particularly benefit creators, businesses, community leaders and individuals who regularly interact with people they do not know personally.
Cybersecurity experts recommend that users exercise caution when receiving messages from unfamiliar usernames, even if they appear to belong to someone they recognise.
They advise users to:
1. Verify identities through another trusted communication channel before sharing sensitive information.
2. Be cautious of usernames containing unusual spellings, extra characters or subtle letter substitutions.
3. Avoid clicking links sent by unknown contacts.
4. Enable two-step verification to strengthen account security.
5. Report and block suspicious accounts immediately.
Users should also be wary of anyone requesting money, passwords, verification codes or financial information through WhatsApp chats.
While WhatsApp's username feature has the potential to improve user privacy significantly, experts say its success will ultimately depend on robust security controls and users remaining vigilant against increasingly sophisticated impersonation tactics.
Comments
Sign in with Google to comment, reply, and like comments.
Continue with Google