WhatsApp Rolls Out Usernames Feature Amid Israeli Brand Impersonation Concerns

WhatsApp has begun gradually introducing a new usernames feature to a limited number of users, marking a significant change in how people connect on the platform. Instead of relying solely on phone numbers, users will be able to select unique usernames to share for contact purposes, enhancing privacy by keeping phone numbers hidden from those who do not need them. Usernames must be 3 to 35 characters long, include lowercase English letters, numbers, dots, or underscores, and contain at least one letter.

However, testing of username availability revealed a concerning vulnerability for Israeli brands. Several usernames containing website addresses of major Israeli companies, including one of the country's largest credit card firms, were freely available for registration. While WhatsApp blocks usernames based on international domains ending in ".com," it currently does not prevent registration of usernames with the Israeli ".co.il" domain suffix. This gap could allow malicious actors to reserve usernames linked to well-known Israeli brands.

Meta responded by stating that the usernames feature is not yet fully available and will be launched gradually later this year. To protect against impersonation, WhatsApp has pre-reserved prominent usernames belonging to public figures, government bodies, celebrities, and verified Meta accounts, along with similar variations. Despite the new feature, phone numbers will still be required to use WhatsApp. Additional safeguards include limiting the number of new contacts a user can message, blocking repeated attempts to guess usernames, and deploying systems to detect and remove impersonation and abuse patterns.

The rollout is currently limited to a small user group as part of a testing phase before wider availability.