WhatsApp Usernames Are Coming — Would You Recognise a Fake One?

Last reviewed: July 2026. WhatsApp has announced optional usernames, with reservations being introduced ahead of a wider planned launch. The feature, its safeguards and rollout plans may change before full release.

WhatsApp is preparing to let users communicate through usernames rather than displaying their phone numbers to new contacts. That could be useful for customer enquiries, business networking, community groups, marketplaces, creators and employees who do not want to expose personal numbers.

However, regulators in India have raised concerns that usernames may also make impersonation, phishing and fraud easier. For businesses, the practical question is simple: how will staff and customers know that a WhatsApp username genuinely belongs to the person or organisation it appears to represent?

A recognisable username is not the same as verified identity.

What is WhatsApp changing?

WhatsApp has announced optional usernames. A username may allow someone to share a name instead of a mobile number, contact new people without immediately disclosing their number, create a more consistent identity across WhatsApp and other Meta services, and use an optional username key for additional control over who can start a conversation.

• A mobile number will still be required to create the underlying WhatsApp account.
• Usernames are intended to be optional.
• WhatsApp says users will not simply become searchable through a public directory.
• A person may need to know the exact username before starting a conversation.
• The final implementation may change before the wider launch.

Why has India raised concerns?

The Indian government asked Meta to pause the username rollout in India while it examined the potential risks, including impersonation, phishing, online fraud, identity spoofing, so-called digital-arrest scams and criminals hiding their phone numbers from potential victims. WhatsApp has said it is building safeguards into the system and has submitted a response to the government.

This is a live regulatory issue. It is not evidence that every username interaction will be unsafe, and it is not a worldwide ban. India’s intervention does not automatically apply in the UK.

Why could usernames be useful?

• Staff could communicate without exposing personal mobile numbers.
• Customers could contact a business using a memorable identity.
• People could interact in community groups with greater privacy.
• Marketplace users could avoid sharing a phone number immediately.
• Businesses could create a consistent customer-contact identity.
• Creators and professionals could separate public contact from personal details.

The privacy benefit is genuine, but privacy must be combined with trustworthy identity checks.

Why could usernames create fraud opportunities?

Criminals already exploit familiar names, logos and profile photographs. A username system could potentially enable names that resemble accounts teams, managing directors, bank support desks, supplier payment departments, public bodies or customer-care teams.

The risks include exact-name disputes, similar spellings, added punctuation, substituted letters, added numbers, misleading profile photographs, copied business logos, false job titles and fake verification claims.

As a fictional, illustrative example: a genuine account might use the username below.

altitudeitsupport

A criminal might attempt lookalikes such as:

altitude-it-support
altitudeitsupp0rt
altitudeitsupport-help
altitude_support_team

Could WhatsApp prevent impersonation?

WhatsApp has described planned safeguards, which may include reserving certain well-known names, limiting contact with large numbers of new users, restricting repeated attempts to guess username keys, displaying contextual information about new contacts, detecting patterns associated with abuse and protecting some verified or prominent identities.

However, no automated safeguard can guarantee that every misleading username will be blocked. Variations and lookalike names may still create confusion, final safeguards may change before launch, and businesses should not rely solely on platform controls.

What does this mean for UK businesses?

Businesses increasingly use WhatsApp for customer enquiries, appointment confirmations, order updates, supplier conversations, employee groups, technical support, delivery coordination and informal approval requests.

That creates risk when staff treat a message as trustworthy simply because it contains a familiar name, a company logo, a senior employee’s photograph, previous conversation details or an apparently correct username.

WhatsApp is a communication channel, not an identity-verification system.

The scams businesses should prepare for

1. 1Fake supplier payment requests — a criminal imitates a supplier and asks for bank details to be changed.
2. 2Executive impersonation — a message appears to come from a director requesting an urgent transfer, gift cards or confidential information.
3. 3Fake customer-service accounts — a criminal pretends to represent the business and contacts its customers.
4. 4Employee impersonation — a message claims that an employee has changed their number or account.
5. 5Account recovery scams — someone asks for a registration code, verification code or device-linking approval.
6. 6Recruitment scams — a fake company account offers jobs, collects personal information or requests payment.
7. 7Technical-support scams — a sender claims an account, device or payment is at risk and pressures the victim to act.
8. 8QR-code or linked-device scams — a user is persuaded to scan a code or approve a new device, potentially exposing their account.

How should staff verify a WhatsApp message? Stop, check and confirm

1. 1Stop. Do not act immediately on an urgent request.
2. 2Check. Look closely at the exact username, spelling, profile information, account age or contextual warnings, unexpected country information, unusual language, changes in tone, requests for secrecy and any changes to bank details.
3. 3Confirm. Use a separate, trusted communication method: call the known telephone number, email the established business address, speak to the person directly, check the supplier record or use an approved internal system.
4. 4Record. Keep evidence of suspicious messages and report them through the appropriate process.

How should a business present its genuine WhatsApp identity?

• Use one clearly documented account where practical.
• Publish the genuine contact method on the official website.
• Use consistent branding and keep the business profile accurate.
• Avoid operating unofficial accounts without oversight.
• Clearly state what staff will and will not request through WhatsApp.
• Inform customers that payment details will not be changed solely through messaging.
• Preserve ownership of the underlying telephone number.
• Control administrator and device access.
• Review any username before promoting it publicly.

A logo or business profile does not provide guaranteed verification. Your website should be the trusted reference point customers use to confirm how your business communicates.

Should businesses reserve their name?

Where username reservation becomes available, businesses may wish to consider reserving the main trading name, a consistent brand name, a name already used on Facebook or Instagram, and obvious legitimate variants where permitted and necessary.

However, availability will vary, platform rules may restrict reservations, and reserving one username will not prevent every misleading variation. Businesses should not engage in speculative mass registration, and the process should be handled through an account the business controls.

Securing the obvious name may help, but customer education and verification processes remain essential.

WhatsApp Business account ownership

Business-critical accounts should not depend entirely on one employee’s personal phone, a former employee, an external marketing agency, an unmanaged SIM card, an unknown recovery email or a device without a screen lock.

Businesses should record the underlying phone number, who owns the number, which devices are linked, who has access, recovery information, two-step verification details, handover procedures and what happens when someone leaves.

Messaging accounts should be reviewed regularly as part of the organisation’s Operational Heartbeat, just like email, domains and social-media accounts.

How to improve WhatsApp account security

• Enable WhatsApp two-step verification.
• Add and verify a recovery email where supported.
• Never share registration codes.
• Review linked devices and remove any that are no longer recognised or required.
• Keep the phone and WhatsApp application updated.
• Use a strong device passcode and biometric protection where appropriate.
• Restrict who can access the business device.
• Back up conversations according to business policy and protect any encrypted-backup password or key.
• Train staff to identify impersonation.
• Report and block suspicious accounts where appropriate.

Two-step verification is a strong safeguard, but it does not prevent every attack.

What should you tell customers?

A short customer-facing statement helps set expectations. For example:

“Our official WhatsApp contact details are published on our website. We will never ask you to disclose a WhatsApp registration code or change payment details without separate verification.”

Businesses should adapt this wording to their own processes — and not every organisation needs to use WhatsApp at all.

What should businesses do now?

1. 1Identify all WhatsApp accounts used for business.
2. 2Confirm who owns the numbers and devices.
3. 3Enable available account-security features.
4. 4Publish the genuine contact route on the official website.
5. 5Create a separate verification process for payments and sensitive requests.
6. 6Brief staff and schedule regular account reviews.

Signs your WhatsApp use needs urgent review

• The account belongs to an employee personally.
• Nobody knows the two-step verification PIN.
• Several unknown devices are linked.
• Former staff may still have access.
• Customers receive messages from unofficial accounts.
• Bank-detail changes are accepted through messaging.
• Staff routinely share confidential information in informal groups.
• The business cannot recover the account if a phone is lost.
• The official WhatsApp number is not published anywhere.
• Nobody monitors impersonation reports.
• The account uses an old or unsupported device.
• Staff assume a familiar name or photograph proves identity.

Why business owners should care

WhatsApp conversations often feel more personal and immediate than email. That familiarity can lower people’s guard.

A convincing fake account could cause fraudulent payments, loss of customer trust, exposure of personal information, unauthorised account access, reputational damage, disruption to customer service and confusion over genuine company communications.

The issue is not whether usernames are good or bad. The issue is whether businesses are prepared to verify identity when a phone number is no longer visible.

The IT Club View

WhatsApp usernames could provide a useful privacy improvement. Employees should not have to expose personal mobile numbers simply to communicate with customers, suppliers or community groups.

But removing the visible number also removes one of the clues people currently use when deciding whether a message is genuine. A username, profile photograph or company logo can all be copied or closely imitated.

Businesses therefore need a stronger rule: trust the process, not the profile. For payments, confidential information and unusual requests, identity should be confirmed through a separate trusted channel.