WhatsApp’s New Privacy Feature Weaponised by Cybercriminals, Experts Warn

**Tim Elliott** (0:00)
This is the Morning Drive. It's Mira Business FM. You've probably heard about the new WhatsApp username feature, which is, while it's designed to boost privacy, I suppose, experts are warning it could be a new weapon for cybercriminals, making impersonation and scams easier than ever. AI-driven fraud is reaching new levels of complexity, and it raises questions.
For example, are businesses and consumers equipped to handle it? Now, today, we're going to unpack the growing tension between privacy-first features and, I guess, the risk of automated impersonation. What does it take to maintain a defensive edge? That will be the question. Nikita Astionov is the founder of the UE-based cybersecurity human risk consultancy. It says here, Cyronel, he's with me this morning. It's good to meet you.

**Nikita Astionov** (0:54)
Good to meet you. Likewise.

**Tim Elliott** (0:56)
Nice to have you here. Look, I've made lots of notes here, because I'm not a very tech cybersecurity guy. So bear with me, but I've noticed, obviously, what's that rolling out the username feature.
So it promises a way to connect, I suppose, without handing out personal phone numbers. So on the face of it, I'm looking at it thinking, well, good, I'm not going to get any more of these calls. The other thing, though, I suppose we don't want to share our numbers, but experts and governments and regulators are warning of a potential disaster. So what makes a username different from a phone number in the eyes of a fraudster, Nikita?

**Nikita Astionov** (1:36)
Right, of course. So, yeah, as you very well said, the new feature of the WhatsApp, where you have a username instead of the phone number. Now, to better understand this, we need to understand why this was implemented in the first place, looking at it from the security perspective, of course. So Matt, at the parent company of WhatsApp, rolled out this feature to essentially hide the phone numbers of users for a privacy reason.
Now, how does this help? For instance, if you're going to order anything from a grocery store, from Talibot, for instance, you would usually have your phone number input. Now, this creates risks and exposes your personal phone number out to the internet or cybercriminals. Now, this WhatsApp feature, now you have usernames. These usernames work similarly to how you would have a username on Instagram, for instance. They're unique to a person, so the moment this username comes out, only one person in the world could have it. And then this essentially hides your phone number and creates a level of privacy. Now, why do cybersecurity experts actually see this as a level of concern in terms of security?
This is simply because majority of attacks target humans, and majority of successful attacks are impersonation attacks.

**Tim Elliott** (2:44)
Right.

**Nikita Astionov** (2:45)
So to explain it a bit more, for instance, I'll give you a quick example to help everyone understand. For instance, you were one of the lucky people to get your name. For instance, your name is Cole with an O.
And you were one of the first people to get that username on WhatsApp and reserve it, as they say.
Now, later on, once this feature rolls out, because this feature isn't out yet. There's podcasts to be by the end of this year. So once this feature rolls out, for example, a name Cole with the letter O, now the attackers are going to think differently. They're going to think that, okay, we don't have a phone number anymore, but we can try to impersonate this person. How would that work? Let's say the letter Cole, C-O-L-E, username. The letter O, you can find the letter O in other languages, such as the Cyrillic alphabet, in Russian, Serbian, et cetera. And you replace one letter with the English alphabet, that's already a unique username, and that's how impersonation starts.

**Tim Elliott** (3:40)
Okay, so really as simple as that. I mean, in simple cases, you can replace an O with a zero.

**Nikita Astionov** (3:46)
Yes, for example, yes, of course.

**Tim Elliott** (3:49)
Okay, right, I'm with you, I'm with you. So could this be the next kind of, I don't know, frontier for sophisticated scams?
I mean, I suppose in theory, that's why there's this ferruri.

**Nikita Astionov** (4:03)
Yeah, of course, this is a boom. And to be frank with you, this is not a new thing, right? This existed for decades now, and on different platforms, and different softwares that people use also include usernames. These types of attacks are common. It's just a new thing for WhatsApp. It's a new, you could say, a threat vector that has emerged with this so-called security new feature. It is a feature for security purposes. It helps privacy, it enhances it. However, it does create this concern that we have to be aware, we have to have that cyber resilience and proper judgment to be able to differentiate between these types of attacks.