ZeroFox Intelligence Flash Report - Introduction of WhatsApp Usernames

In this Flash Report, ZeroFox researchers report on the recent announcement by Meta introducing usernames on Whatstapp.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

View the full report here

On June 29, 2026, Meta began allowing WhatsApp’s three-billion-plus users to reserve a username that new contacts can use instead of a phone number, ahead of a phased, country-by-country rollout later in 2026.
ZeroFox assesses the feature will likely act as a threat multiplier by increasing the credibility of impersonation and social engineering campaigns rather than introduce a fundamentally new attack method.
Meta has reportedly reserved usernames tied to public figures, government entities, celebrities, and verified accounts and added limits on new-contact messaging volume and username key guessing; ZeroFox assesses these controls will likely reduce, but not eliminate, abuse.
Within 48 hours of the announcement, India’s Ministry of Electronics and Information Technology (MEITy) issued a formal notice warning the feature could materially increase online fraud, phishing, digital arrest scams, and impersonation attacks and temporarily paused rollout in that market; Finland’s national cyber authority (Traficom) issued a similar public warning in early July.
ZeroFox assesses that impersonation risk is very likely to be highest during the initial rollout window, as threat actors test platform controls and attempt to register deceptive usernames before enforcement matures.