WhatsApp Usernames: A Way to Ensure Privacy… and Security?

Meta has launched a new feature: usernames on WhatsApp, to allow individuals and businesses to hide their phone numbers

3 billion people use WhatsApp, Meta’s instant messaging app, to send messages and make video calls with family, friends, coworkers, customers, partners, and businesses…

WhatsApp’s importance in both our personal and business communications compels us to focus on two critical issues of our time: the privacy of our personal data—such as our phone numbers—and security against digital fraud or cyberattacks.

Just a few days ago, a WhatsApp phishing campaign was made public in which malicious actors used previously compromised WhatsApp accounts to send their contacts documents that appeared to be invoices or financial reports, but which, when opened, triggered the download of software that allowed the attackers to gain access to the victims’ devices.

This case is not an isolated incident; rather, it highlights the importance of WhatsApp to malicious actors when deploying social engineering techniques.

Well, Meta has just announced the launch of two new features to strengthen privacy and security: WhatsApp usernames and username passwords.

By using WhatsApp usernames, the company aims to safeguard users’ phone numbers. Thus, instead of displaying phone numbers, the app will show usernames.

Meanwhile, the creation of username passcodes is intended to act as a filter when receiving messages on WhatsApp. Consequently, to start a conversation with a user who has a passcode, you’ll need not only to know their exact username but also to have the passcode.

Below, we’ll address the main questions surrounding WhatsApp usernames and username passcodes—two features the company will roll out gradually over the coming months.

How do usernames work on WhatsApp?

Until now, if you wanted to message someone on WhatsApp, you needed to know their phone number. Once usernames are implemented on WhatsApp, this will no longer be the case.

You’ll still be able to find someone in the app if you have their number, but you’ll also be able to start a conversation with someone if you know their exact username. In other words, unlike, for example, Telegram, WhatsApp will not enable a username search feature within the app; instead, to message a user—whether an individual or a business—you’ll need to know their username.

What is the purpose of usernames on WhatsApp? To prevent, for example, users’ phone numbers from being visible in WhatsApp groups. This is particularly relevant given the growth of WhatsApp groups, which are used not only for personal relationships but also in professional, business, academic, and recreational contexts.

Likewise, thanks to the implementation of usernames on WhatsApp, a person can share their nickname to start conversations with others or organizations without revealing their phone number.

How does the process of creating usernames on WhatsApp work?

Given WhatsApp’s enormous user base, Meta has not only announced the gradual rollout of this new feature but also opened the ability to reserve usernames.

Simply type in the name you want to reserve, and if it’s not already taken, WhatsApp will let you complete the process.

Therefore, individuals and businesses can now reserve their usernames; once they become available, WhatsApp will notify them.

Can someone hijack the username of a company, organization, or public figure?

One of the main concerns raised by the rollout of usernames on WhatsApp is the impersonation of organizations or public figures by taking over their usernames on social media.

For example… can someone take the username @tarlogicsecurity, which is our Instagram handle? Meta states that this is not possible. Even if someone reserved that name before we did, since it is our company’s Instagram handle, Meta would assign it to us if we requested it—even retroactively.

This mechanism is key to preventing identity theft for companies, institutions, and individuals alike.

In addition, the company has also indicated that some names of companies, governments, and public figures have already been reserved by default and therefore cannot be claimed by others.

Will it be possible to send WhatsApp messages to people or companies just by knowing their Instagram username?

The link between social media usernames and WhatsApp usernames has an implication we cannot ignore: it’s possible to start WhatsApp conversations with companies or organizations without knowing their phone numbers—all you need is their Instagram username.

This means that a freelancer who uses WhatsApp for business purposes may receive messages from people who are not clients or suppliers. Or that a public figure may receive hundreds of WhatsApp messages, disrupting their ability to use the app to communicate with their contacts.

What are WhatsApp username keys, and why can they be essential for preventing social engineering attacks?

To mitigate this risk, Meta has developed a feature for WhatsApp usernames: username codes.

How do they work? If a user creates a code for their username, no one will be able to message them unless they have:

1. Their exact username.
2. Their username key.

This means that, even if someone knows a company’s or person’s nickname—because it’s the same as their public Instagram handle—they still can’t message them unless the user has previously provided their code.

In other words, username keys on WhatsApp help create a barrier against strangers, as well as against social engineering campaigns and WhatsApp scams.

What problems could the use of username keys present? It significantly limits interactions through this app, which can be detrimental in business and professional settings.

For example, consider a restaurant that manages its reservations through WhatsApp. Potential customers wouldn’t be able to message the restaurant unless they had its password. The same would apply to a law firm that uses WhatsApp to attract clients and gather information about their cases. The examples are endless. In the business world, the use of user passwords on WhatsApp could hinder its use as a key communication and business tool.

How might malicious actors adapt to the new landscape created by WhatsApp usernames?

It’s clear that WhatsApp usernames will help safeguard the privacy of our phone numbers.

But this won’t prevent malicious actors from continuing to send phishing campaigns via WhatsApp using phone numbers obtained illegally through data breaches or phishing attacks. This is because even if a person has a username, they can still start a conversation if their phone number is available.

Beyond this, it’s important to pay attention to the new opportunities that could open up for malicious actors to use social engineering techniques.

Especially when we consider the link between a person’s username on Instagram or Facebook and their username on WhatsApp.

Why? For example, if username locking isn’t enabled, anyone could search for a user on WhatsApp by their Instagram username and message them.

If we also consider that it’s possible to see on Instagram who a person follows and who follows them, their identity could be impersonated by creating an account with a username nearly identical to theirs and a profile picture taken from their IG account, and using it to try to deceive their followers.

Risks for Businesses

In the business world, there is a risk that a company’s identity could be impersonated, and fraudulent campaigns could be launched via WhatsApp targeting its followers, who, in many cases, are also its customers.

For example, consider a retail company. Malicious actors create a WhatsApp username using the company’s name and adding the year it was founded. There’s nothing to suggest it isn’t real. They then send a message to all their followers whose WhatsApp usernames match their Instagram ones, offering a special deal accessible via a link.

The page they land on appears to be genuine, so they click on it—thereby downloading malware, entering their legitimate credentials to access the company’s customer portal, or even making fraudulent payments while believing they are purchasing products.

It’s clear that this type of threat can be nipped in the bud using username keys. However, as we’ve already noted, it’s also likely that quite a few people or organizations will choose not to create these keys, since they act as a barrier to receiving WhatsApp messages from new customers, partners, coworkers, and anyone else they haven’t yet interacted with via the app.

As with any technological innovation, malicious actors will develop new techniques, tactics, and procedures tailored to WhatsApp usernames to continue social engineering attacks against individuals and companies.

That is why experts in cyber intelligence and social engineering will play a key role in investigating the campaigns that continue to be launched on WhatsApp, the fight against identity theft targeting companies and individuals of interest, and in educating and raising awareness among the public.

What can companies and public figures do to combat identity theft?

Identity theft targeting organizations and public figures poses a threat not only to the victims of fraudulent campaigns but also to the companies, institutions, and individuals whose identities are used for illicit purposes. These actions cause significant damage to a brand’s or public figure’s reputation and erode customer and citizen trust.

Companies, institutions, and public figures can turn to fraud investigation and analysis services to:

• Conduct early detection of identity theft on both WhatsApp and other platforms.
• Neutralize fraudulent activities as quickly as possible.
• Implement threat mitigation measures.
• Design preventive measures adapted to changes in the techniques, tactics, and procedures used by malicious actors.
• Help quantify the financial and reputational damage caused by fraud campaigns.
• Provide evidence to support the legal strategy that the company, institution, or public figure implements against the perpetrators.

How can organizations protect themselves against social engineering attacks via WhatsApp?

For companies, it is not only essential to combat identity theft but also critical to prevent social engineering attacks targeting them, their executives, and their entire workforce.

Thus, social engineering campaigns specifically targeting professionals and business owners are systematically documented. To what end? To trick them into making or authorizing payments, providing their login credentials for corporate software, or downloading files infected with malware.

Therefore, given the changes brought about by the implementation of usernames on WhatsApp, it is essential that companies regularly conduct social engineering tests tailored to the latest developments in malicious techniques, tactics, and procedures.

These tests simulate real social engineering attacks to verify an organization’s resilience and to train and raise awareness among employees and executives.

If a WhatsApp user with a name matching that of a supplier—and who has a profile picture of that supplier—sends an invoice to a company’s WhatsApp account or to its billing manager… Would the invoice be downloaded and opened on a corporate computer?

It is essential to consider these types of scenarios to prevent fraud attempts and security incidents.

Ultimately, the implementation of usernames on WhatsApp raises a key issue of our time: the protection of personal data—in this case, a sensitive number like our phone number. But it also opens up a new way to initiate a conversation with someone on WhatsApp.

On the one hand, the ability to set username passwords significantly limits the number of messages received, which is an important security measure, but can also be an obstacle to establishing communications in business, professional, and personal contexts.

On the other hand, the link between social media nicknames and WhatsApp makes identity theft more difficult, but it also opens the door to a situation where, without a username and password, anyone can send a WhatsApp message to a company or an individual without needing to know their phone number—simply by using their Instagram nickname.

Furthermore, as with any technological change, the adoption of usernames on WhatsApp will require us to monitor how malicious actors adapt their techniques, tactics, and procedures to this new landscape and, in turn, continue to combat identity theft and fraudulent campaigns on WhatsApp.