For most Malaysians, WhatsApp is not one app among many. It is the app, the default way tens of millions of people talk to family, run side businesses, and reach customer service. So when Meta starts changing how people find and message each other on it, the ripple reaches almost every phone in the country.
WhatsApp this week began rolling out username reservations, the first step toward letting people use WhatsApp usernames to connect by a handle instead of a phone number. Meta frames it as a privacy upgrade. As TechCrunch reports, the feature is already drawing scrutiny from security researchers and regulators, most sharply in India, WhatsApp's largest market with more than 500 million users.
Editor
Kai T chevron_right
Table of Contents
What WhatsApp usernames actually change
Today your phone number is your identity on WhatsApp. Under the new system a username becomes the way strangers reach you, so you can message a seller, a support line, or a group without handing over your number. Meta says it reserves usernames for public figures, government bodies, and "some variations" of those names, so only the legitimate owner can claim them. Yet in early testing, TechCrunch found handles resembling politicians, celebrities, and even a central bank still available to reserve. Binance founder Changpeng Zhao said he could not secure the handle he already uses on another platform.
Why Malaysia should pay attention
The impersonation worry lands hard here. WhatsApp reaches about 90.7% of Malaysian internet users and holds roughly 80% of the local messaging market, far ahead of Messenger and Telegram, according to DataReportal. That reach is exactly what fraudsters exploit. Malaysians lost close to RM3 billion to online fraud in 2025, up from RM1.57 billion a year earlier, the Home Ministry says. Telecom-style fraud alone, including Macau scams and voice phishing, drove 28,698 cases and RM715 million in losses, often with criminals posing as police, Bank Negara, or health officials.
A username system that hides the sender's number could make those scripts easier to run, not harder. A handle like "bnm_verify" or a near-copy of a bank's name reads as official to a rushed victim, and there is no phone number left to sanity-check against.
India is writing the playbook regulators will read
India's IT ministry warned WhatsApp this week that the feature could "materially increase" fraud, phishing, and impersonation, and asked the company to hold the rollout until consultations finish. Not everyone agrees with that approach. The Internet Freedom Foundation argued the order lacked a clear legal basis and risked letting officials dictate product design by private letter. It is the kind of dispute that tends to end up as a template other governments borrow from.
Malaysia has its own levers. Since January 2025, WhatsApp and its peers fall under the Malaysian Communications and Multimedia Commission's Application Service Provider Class licensing regime, and Putrajaya has already signalled it is willing to take platforms to task over weak cooperation on scams. Whatever India settles on will be within easy reach of MCMC and Bank Negara.
What you can do before it lands here
Rachel Tobac, chief executive of SocialProof Security, calls usernames a real privacy gain, since sharing a handle beats leaking a phone number that invites SIM-swap and phishing attacks. Her advice: when reservations reach Malaysia, pick a username that is hard to guess, and never trust a handle on its own. Verify who you are talking to through a second channel, the same discipline the National Scam Response Centre has pushed for years.
Usernames could make WhatsApp both safer to hand out and easier to fake. For a country this dependent on the app, how carefully Meta polices the lookalikes will matter more than the feature itself.
Image(s) courtesy of lonely blue and Ice Family on Unsplash.