WhatsApp's New Usernames Feature Opens a Fresh Opening for Scammers

WhatsApp is rolling out a new usernames feature that will allow people to connect and message one another without sharing their phone numbers. With the app used by the vast majority of people in Ireland, security experts are urging Irish users to stay alert to how the change could be exploited by fraudsters.

The new feature lets users choose, change or remove a username at any time. It will roll out across the platform over the coming months, with username reservations opening this week. A phone number is still required to create an account, and while WhatsApp says the move gives people greater control over their personal information, account data such as who a person communicates with and when continues to be collected.

For Irish consumers, already among the most frequently targeted by smishing and impersonation fraud, the concern lies less with the feature itself than with how it may be misused. A username that looks friendly and familiar can carry a sense of trust that an unknown number never could, giving scammers a new way to pose as a contact, an employer or a well-known brand.

George Foley, security spokesperson for ESET Ireland, said:

"People are often cautious when they see an unfamiliar phone number, but a friendly username can feel more trustworthy while telling you less about who you're talking to.

Even with built in protections, scammers will look at the new features and attempt to exploit them. Scams won't necessarily become more sophisticated, but they'll likely shift from phone numbers to convincing usernames that spoof your contacts, employer, brands, or services.

Therefore, if someone claims to be anyone from an employer to your friends and family, it is still vital to verify them through a trusted channel before sharing information or sending money. It's also advisable to set your username key up so only people who know it can contact you."

The advice for WhatsApp users is to treat any unexpected message asking for money or personal details with caution, no matter how recognisable the sender's username appears, and to confirm the person's identity through a separate, trusted channel before acting.