← All writing

STOP! Do not link your WhatsApp username to your Instagram handle

2 min Quick Take

WhatsApp is rolling out usernames. Soon people can message you without ever seeing your phone number, which is a genuinely good change. But it only protects you if nobody can guess your username. That is the part everyone is about to get wrong.

The entire security model is one sentence, from WhatsApp’s own VP of product: “People will need to know your exact username to contact you for the first time.” No directory, no search. Your username is meant to work like a secret.

Reuse your Instagram handle and every stranger who finds your profile is one guess away from your phone.

Doxxing just got a shortcut. Today, someone who finds you on Instagram hits a wall. They do not have your number. Reuse your handle and the wall is gone. They type the same handle into WhatsApp and land in your private chats. No hacking, no leak. One guess.

Girls, think about this one properly. You know the random guys in your comments and message requests. Now imagine them messaging you on WhatsApp, on your actual phone, whenever they want. Blocking them on Instagram no longer ends it. Matching handles turns your WhatsApp into an open DM box for every stranger you never accepted.

Your parents are targets too. Impersonation is about to get much easier. A scammer who connects your Instagram to WhatsApp knows your face, your name, your family. A lookalike username and a “hi mum, new number” message is all it takes. Sit down with your parents and set them up properly before someone else reaches them first.

Four things, right now:

  1. Pick a WhatsApp username with nothing from your public handles in it.
  2. Set a username PIN, so strangers need your handle plus a PIN before they can message you for the first time.
  3. Set your profile photo and status to contacts only.
  4. Send this to your family and check your parents’ settings yourself.
Three WhatsApp screens showing the username creation flow, the username settings page, and the Username PIN setup screen
The username and PIN screens as they appear in the app. People you have never chatted with must enter your PIN before they can message you. Screenshots via WABetaInfo.

Usernames go fully live later this year. Get this right before they do. Full details on how reservations and PINs work are in Al Jazeera’s rundown.