Using names on WhatsApp enhances privacy, but can create new opportunities for scams

The feature promises to increase control over the exposure of personal data, but it could create opportunities for fraud; a Skyone expert explains how to protect yourself

WhatsApp has launched a feature that allows people to create a username (@username) to start conversations without having to share their phone number. This is one of the most significant updates made by Meta since the app's official launch in 2009.

Although this new feature represents an important step forward for user privacy, experts warn that it could also give rise to a new generation of digital crimes. With the adoption of usernames, criminals tend to adapt their strategies to create fake profiles, use names very similar to those of well-known companies and people, and carry out scams such as money requests, fake call centers, fraudulent promotions, and requests for verification codes.

With the new feature, the phone number will no longer be automatically displayed when someone first contacts another person or company using that identifier. There will also be no public directory for searching profiles: it will be necessary to know the exact username to start a conversation. In addition, WhatsApp will offer an optional security key to restrict who can send messages for the first time.

“Privacy increases because the user gains more control over when sharing their number. But trust cannot be transferred to the username. Before responding or taking any action, it will be increasingly important to verify who is really on the other side of the conversation,” says Bruno Caldas, Head of Cybersecurity at Skyone.

In practice, the expert assesses that the first months of adoption of the feature should concentrate on fraud attempts with profiles that imitate companies, banks, and well-known people. The strategy tends to exploit small changes in the username to induce the victim to believe that they are talking to a legitimate contact and, thus, obtain payments, personal data, or authentication codes.

According to Meta, public figures and prominent brands will have protection against impersonation attempts. Even so, Caldas emphasizes that no technology can completely prevent the creation of misleading profiles.

The choice of username can also contribute to security. The recommendation is to opt for an identifier that is easy for friends and family to recognize, but that does not expose personal information.

Among the precautions recommended by the specialist are:

Avoid providing your CPF (Brazilian tax identification number), date of birth, or year of birth

Do not combine your full name with your profession or company;

Avoid repeating the same username across all digital platforms;

Choose a name that is difficult to confuse with another profile.

Even with the new feature, some measures remain essential to protect your account:

Enable two-step verification;

Limit who can view photos, messages, and statuses;

Control who can add the user to groups;

Keep the app always updated;

Review your privacy settings periodically.

“Technology is constantly evolving, but awareness remains one of the most effective forms of prevention. Whenever you receive an unexpected message, especially one involving money, verification codes, or urgent requests, it is best to confirm the person's identity through another channel before taking any action,” advises Caldas.

The change should also impact companies that use WhatsApp as a customer service channel. According to the expert, it will be important to clearly disclose official usernames, monitor accounts that use names similar to the brand, and advise customers never to share passwords or authentication codes via messages.

“Customer trust will increasingly depend on clear communication. In addition to security tools, it will be essential for companies to explicitly state their official channels and train their teams to guide consumers in the face of potential fraud attempts,” concludes the Skyone expert.

Written by Skyone