WhatsApp Usernames for Business: What Changes in 2026

On June 29, 2026, WhatsApp opened global reservations for usernames, something the app has never had. Soon people will be able to message a business using a handle like @yourbrand instead of a phone number. Most coverage treats this as a privacy story, and it is one. But there's a second change sitting underneath the headline feature, and it's the one that will show up in your numbers if you run click-to-WhatsApp ads or handle inbound leads through a CRM.

This is for anyone running customer communication through WhatsApp who wants the second half of the story.

What WhatsApp launched

Usernames let a WhatsApp user be found and messaged by a unique handle instead of a phone number. Handles run 3 to 35 characters, lowercase letters and numbers, periods and underscores allowed, and must start with a letter. A phone number is still required to register and recover the account, so this is contact privacy, not anonymity, and every conversation stays end-to-end encrypted however it started.

Rollout is in country waves. The first went live July 7, 2026, in Algeria, Azerbaijan, Ghana, Libya and Nepal. A second wave follows July 20, 2026. The rest of the world starts from September 2026. Reservations opened globally the moment the announcement went out, so people and brands in markets that haven't gone live are already claiming handles.

For businesses there's a specific, easy-to-miss detail. A business username does not hide your business phone number. Your number still shows on your profile. Business usernames are a discoverability and branding layer, not a privacy shield, and what you tell customers should reflect that rather than promising something the feature doesn't deliver.

The privacy part, for users

For personal accounts the privacy design is thought through. No public directory and no autocomplete search, so a stranger needs your exact handle, not a rough guess. WhatsApp is also adding a username key, a short code the account owner can require before a new contact can message them through their handle. Anyone who reaches out without it doesn't land straight in the main inbox.

That protection has a carve-out that matters for businesses. If you already have a prior connection with a customer - their phone number, their BSUID, or a recent exchange - WhatsApp's own documentation confirms you don't need the username key to reach them. The gate is for cold outreach from strangers, not for a business continuing an existing relationship. That distinction matters a lot in the next section.

The change that affects your business: BSUID

To support usernames, Meta introduced a Business-Scoped User ID, or BSUID, a unique identifier assigned per user, per business. The same WhatsApp user has a different BSUID with every business they message. It's been showing up in inbound API webhooks since early April 2026, and it appears for every contact now, not only the ones who've adopted a username.

Your developer isn't the only one who needs to know this. If someone with a username clicks a click-to-WhatsApp ad and has never messaged your business before, that conversation can now arrive carrying only a BSUID and no phone number. A CRM, lead router or chatbot built on the assumption that every contact shows up as a phone number simply won't recognise that lead. No error, no bounce. The ad spend registers, the click counts, and the contact lands in a field your system doesn't know how to read.

That's the real story under the username headline. A slice of your inbound WhatsApp leads may stop arriving with a phone number attached, and most systems weren't built with that in mind.

The BSUID itself is a long alphanumeric string prefixed with a country code, something like US.13491208655302741918, and it's stable for the life of that user-business relationship. It only changes if the customer changes their registered phone number. Meta's API started accepting BSUIDs as a valid recipient identifier in May 2026, so a business can now message a customer directly through their BSUID even without their phone number, provided that BSUID showed up in an earlier webhook. It sounds like a backend detail. It isn't. It's the field your ad spend depends on.

What doesn't break

A lot of coverage skips who's actually affected, so it helps to be precise.

WhatsApp built a Contact Book at the portfolio level that automatically stores phone number and BSUID pairs whenever any of your business numbers interacts with a user. Once that pairing exists, the phone number keeps showing up in your webhooks even if the customer later sets a username. Anyone you've already exchanged a message with, and anyone active in the last 30 days on that business number, is unaffected. Outbound messaging to numbers you already have keeps working, and authentication templates like OTPs still require a real phone number, since BSUIDs can't be used for those.

The exposure is narrow but real: brand-new contacts, arriving through a fresh ad click or a first-touch message, who've already adopted a username and have zero history with your business. That's the segment that shows up BSUID-only. Everyone else in your existing base carries over without you noticing anything.

What breaks if you do nothing

Say you're running a D2C skincare brand pushing click-to-WhatsApp ads into a chatbot that qualifies leads before handing them to a sales rep. If that bot keys off phone number as the primary identifier and a first-time visitor arrives via BSUID only, the handoff fails without a sound. Nobody gets an error. The lead doesn't route anywhere useful, and unless someone is watching conversation volume against ad spend, this runs for weeks before anyone notices.

Teams treat identity fields as solved once the integration is live, and it's exactly the assumption that breaks without a sound. The fix isn't a re-platforming project. It's confirming your CRM or BSP reads and stores BSUID as a first-class field alongside phone number, not an afterthought.

Or take a trekking operator running seasonal WhatsApp campaigns to a list built from Instagram click-throughs. A chunk of first-time inquiries during peak season are exactly the profile most likely to arrive BSUID-only - new contacts, no prior history. If the support team is checking a spreadsheet keyed on phone number to match inquiries to bookings, those leads won't show up in the sheet, and nothing in the WhatsApp interface flags the mismatch. The conversation exists in the inbox. It just doesn't connect to anything downstream.

What's good for brands here

There's a real upside, separate from the operational risk. Some customers hesitate before handing a phone number to a brand they've never dealt with. If they can start that conversation through a handle, you may see more people willing to make first contact, particularly for cold or paid lead gen. A consistent handle also travels across WhatsApp, Instagram and Facebook, so @yourbrand can go on packaging, email signatures and QR codes in a way that's easier to promote than asking someone to save a number.

Verified status keeps its place at the top of the trust hierarchy. A username sits below your Meta Verified or Official Business Account badge in how WhatsApp displays a chat, so the blue tick remains the strongest signal. Usernames sit alongside it, not in place of it.

Picture a hotel putting @propertyname on room key cards, checkout receipts and a QR code at the front desk instead of a ten-digit number nobody remembers past checkout. Small thing operationally, but it removes friction at exactly the moment a guest is deciding whether to ask about a late checkout or a taxi. Easier to notice, easier to type from memory, easier to reuse across the same brand's Instagram and Facebook without three different contact points.

Squatting and impersonation are the real risk

Several founders in India flagged concerns publicly within days of the announcement. Their point: near-identical handles, small variations on a known name or brand, are easier to register than most people expect, and removing a phone number from a first interaction removes a quick trust check that less tech-savvy customers rely on. If your brand has any public profile at all, that risk is real.

Claim your own handle and the obvious variants early, keep your verification active, and make sure your support team knows how to handle a customer reporting a copycat account quickly rather than through a general ticket queue. This matters more for brands with name recognition than for a purely local operation, since a recognisable name is what makes a lookalike handle worth registering. If you already deal with fake order confirmations or phishing on other channels, treat username squatting as the same category of risk.

What to do this week

Claim your username now, even if your market isn't live till September. Reserve it through WhatsApp Manager or Meta Business Suite, based on your existing display name, Official Business Account or verified name. Verified and Official Business Accounts get matching priority, so get Meta Verified first if you haven't.

Ask your CRM or BSP one direct question: do we store and match contacts on BSUID, not only phone number. If you're on Twilio, Infobip, 360Dialog or similar, support has generally shipped, but it isn't always switched on by default for every account.

Add a phone number request into your click-to-WhatsApp flow for cold leads. WhatsApp's contact info request button lets you explicitly ask a new contact to share their number mid-conversation, which matters if OTPs, order updates or list-based remarketing depend on having that number. If you're running automated flows on Fufa, this is the next thing to check after your inbox setup, since a broken identity field upstream shows up as a broken workflow downstream. If you want help auditing your click-to-WhatsApp funnel for this gap, book a quick call with our team.

Teams that handle this well aren't doing anything dramatic. They've claimed their handle, confirmed their BSP reads BSUID correctly, and added a contact request step for first-time visitors from ads. Customers with existing history notice nothing. New customers get a slightly smoother way to start a conversation, and the business doesn't lose visibility into who's messaging. Teams that skip it usually find out a few weeks after their market's rollout wave, when someone asks why click-to-WhatsApp conversions dipped without any change to the creative or the offer. By then it's a debugging exercise instead of a five-minute setup task. If you're already watching your delivery numbers, frequency capping is the other variable worth tracking alongside this.

FAQ

What is a WhatsApp username for business?

A unique handle, 3 to 35 characters, that customers can use to find and message your business instead of typing your phone number. It works alongside your existing profile and doesn't replace or hide your business number, which stays visible to anyone viewing the profile.

Does a business username hide my phone number?

No, and this misconception is worth correcting early. Business usernames are for discoverability and branding, not privacy. Your business phone number stays visible on your WhatsApp Business profile whether or not you've claimed a handle. The privacy layer is for personal users.

What is a BSUID and why does it matter?

Business-Scoped User ID, a unique identifier Meta assigns per user, per business. It appears in your API webhooks for every contact, whether or not they've adopted a username. If a first-time contact arrives with a username and no prior history with you, your system may receive only a BSUID instead of a phone number, which is why CRM and chatbot readiness matters.

Will I lose access to my existing customers' phone numbers?

No. WhatsApp's Contact Book stores phone number and BSUID pairs once any interaction happens on your business number, and that pairing carries forward even if the customer later sets a username. Anyone you've already messaged, or who's been active with your number in the last 30 days, keeps showing up with their phone number.

When can I just wait?

If your business relies mainly on inbound support from existing saved contacts, with little cold outreach or click-to-WhatsApp ad spend, the immediate risk is low. Your Contact Book already protects those relationships. Just confirm your BSP has BSUID support switched on before your country's rollout wave.

How do small teams handle the BSUID update without a developer?

Most mainstream BSPs, including Twilio, Infobip and 360Dialog, have shipped BSUID support on the backend. The practical step is one message to your provider's support asking them to confirm BSUID storage and contact matching is active on your account. Usually enough without touching code.

What's the minimum setup to get a real result from claiming a username?

Claiming the handle takes a few minutes in WhatsApp Manager and no technical work. What actually protects your funnel is confirming BSUID handling with your CRM or BSP and adding a contact request step to your click-to-WhatsApp flow for first-time visitors. Those two cover most of the risk.

Should I promote my username to customers now?

You can use it in marketing material as soon as it's reserved, since reservations are live globally before your country's full rollout. Just don't frame it as a privacy upgrade for your business, since your number stays visible. Frame it as an easier way to find and message you, which is what it is.