Listen to the episode
TLDR
Meta now lets WhatsApp users pick a public username instead of sharing their phone number, but reusing the same handle you have on Facebook or Instagram makes it trivially easy for scammers to link your identities. If an attacker spots...
How it works
Meta now lets WhatsApp users pick a public username instead of sharing their phone number, but reusing the same handle you have on Facebook or Instagram makes it trivially easy for scammers to link your identities. If an attacker spots...
Red flags
- You are urged to reuse your Facebook or Instagram handle on WhatsApp via Accounts Center, which fuses your data across Meta apps. Someone contacts you on WhatsApp using a username that matches a known public figure, brand, or institution you trust. A new contact knows personal details (employer, family, hobbies) that match what is visible on your linked Meta profiles
What to do
- 1Pick a WhatsApp only username that does not mirror any social media handle you use elsewhere. Enable a username key under Settings Account Username so strangers also need a secret code to reach you. Restrict group adds and unknown contact visibility under Settings Privacy, and treat every unsolicited WhatsApp message as a potential social engineering at
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/news/2026/07/choose-your-whatsapp-username-carefullyFAQ
Is Choose your WhatsApp username carefully to avoid social engineering scams a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
You are urged to reuse your Facebook or Instagram handle on WhatsApp via Accounts Center, which fuses your data across Meta apps. Someone contacts you on WhatsApp using a username that matches a known public figure, brand, or institution you trust. A new contact knows personal details (employer, family, hobbies) that match what is visible on your linked Meta profiles
What should I do first?
Pick a WhatsApp only username that does not mirror any social media handle you use elsewhere. Enable a username key under Settings Account Username so strangers also need a secret code to reach you. Restrict group adds and unknown contact visibility under Settings Privacy, and treat every unsolicited WhatsApp message as a potential social engineering at
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.