MANILA, Philippines (Jul 2026) – A new privacy feature on WhatsApp that allows users to hide their phone numbers behind custom usernames could open the floodgates for highly convincing impersonation scams. While the upgrade aims to give Pinoys more control over their personal data, cybersecurity experts warn that ditching phone numbers removes a crucial layer of digital accountability.
Data from the Global Anti-Scam Alliance highlights the massive scale of the threat. The organization found that 57 percent of adults worldwide experienced a scam in the past year, with estimated annual losses ranging from $442 billion (approx. PHP 25.9 trillion) to $1 trillion (approx. PHP 58.5 trillion). In Southeast Asia, 63 percent of surveyed adults reported receiving scam outreach over a 12-month period, and 22 percent ultimately lost money to these schemes.
Why your phone number actually protects you
Phone numbers, despite their privacy shortcomings, have long served as an informal identity anchor. Because most Southeast Asian countries require SIM registration, there is usually a thread of accountability tied to a specific number. Usernames carry no such tracking. They are pseudonymous by design, meaning a skilled social engineer can easily create a convincing handle to trick unsuspecting targets.
Regulators in India reacted quickly to the update. Within 48 hours of the announcement, the government ordered a temporary halt to the rollout, warning that allowing anonymous contact could trigger a massive surge in fraud, phishing, and impersonation attacks.
For companies in the region, this shift introduces a legitimate operational risk. Employees frequently use messaging apps to communicate with clients, vendors, and partners. A cybercriminal could easily use a plausible username to impersonate a chief financial officer or a supplier, turning a consumer convenience into a targeted business threat.
How to lock down your account
While popular messaging platforms are reserving usernames for public figures and verified entities, the vast majority of daily business interactions happen between unverified accounts.
Takanori Nishiyama, senior vice president APAC and country manager for Japan at Keeper Security, notes that every shift in digital identity mechanics creates new opportunities for exploiters. He advises organizations to treat this shift as a prompt to reinforce identity verification processes, mandate multi-factor authentication, and upgrade credential management to secure fragmenting digital identities.
Fortunately, a critical security gate exists within the app settings. Users can generate a numeric username key. When enabled, bad actors cannot initiate contact or send a message without possessing that specific key, adding a vital layer of defense against unsolicited messages.
