WhatsApp grew fast because it makes finding someone simple. You add a phone number, the app tells you if that person is on WhatsApp. Easy. The problem is that this same design also made it simple to look up almost anyone’s number at massive scale.
WhatsApp Phone Number Leak: Simple Steps to Stay Safe
Austrian researchers say they were able to enumerate phone numbers for roughly 3.5 billion WhatsApp accounts by automating the normal “add a contact” flow on WhatsApp Web. No fancy exploit. They just tried number after number, the same way any of us would, only with a lot of speed and a lot of automation.
Here’s the part that made my eyebrows go up. For people who had looser privacy settings, the researchers also saw extras. They report seeing profile photos for about 57 percent of users, and the profile “About” text for about 29 percent. That is more than enough context to link a face, a name, and a phone number. If you’re a scammer, that is gold.
Their rig could check close to 100 million numbers per hour earlier this year through WhatsApp Web. Think about that. In a single hour, you can scan the equivalent of multiple large countries worth of numbers. Honestly, it feels obvious in hindsight. If a service tells you who is on it when you add a number, someone eventually tries every number.
Meta, which owns WhatsApp, says this is basic account info that other users can see based on your privacy choices, and that end‑to‑end encryption keeps messages and non‑public data safe. The company says it has not found evidence of malicious actors abusing this exact route at scale, and it says it uses rate limits to make mass scraping harder. The researchers say they disclosed the issue this spring, and that WhatsApp later added stricter limits on bulk lookups in the web client to curb automation.
Why this matters right now. A phone number is sensitive data. With a number, bad actors can attempt SIM‑swaps, targeted phishing on WhatsApp or SMS, and social engineering. Tie in a real photo and an About line, and it gets easier to impersonate you or to craft a convincing message to your family or coworkers.
Good news, you can lock most of this down in two minutes. WhatsApp already gives you switches to control who sees what. Messages stay end‑to‑end encrypted either way.
Do these quick fixes today:
- Hide your profile photo from strangers: WhatsApp > Settings > Privacy > Profile Photo > choose My Contacts or Nobody. This setting is documented in WhatsApp’s Help Center under Who can see my information.
- Limit your About line the same way: Settings > Privacy > About > pick My Contacts or Nobody.
- Tighten your visibility: Settings > Privacy > Last Seen and Online > set to My Contacts. Also check Status and make it visible only to people you trust.
- Stop random group adds: Settings > Privacy > Groups > My Contacts except… then exclude All Contacts to force invites.
- Turn on two‑step verification: Settings > Account > Two‑step verification > Turn on. You set a PIN and a recovery email. This is in the official Help Center under Two‑step verification.
- Silence unknown callers: Settings > Privacy > Calls > Silence unknown callers. WhatsApp introduced this to cut spam calls. You still see missed calls, they just do not ring.
- Protect your IP address in calls: Settings > Privacy > Advanced > Protect IP address in calls. This routes calls through WhatsApp’s servers so the other side cannot see your IP. WhatsApp covered this on its official blog and Help Center.
- Run Privacy Checkup: Settings > Privacy > Start checkup. WhatsApp’s guided flow walks you through the key switches in one place.
A few notes:
- You cannot hide your phone number on WhatsApp. The service is built around phone numbers. What you can hide is your photo, About, Last Seen, and Status, and you can block unknowns from calling or adding you to groups.
- End‑to‑end encryption protects your messages and media. None of this research touched chats, contacts, or any non‑public content. WhatsApp’s security overview explains this clearly.
- If you get spam or a creepy message, report and block right in the chat. That sends recent messages to WhatsApp for review and helps train the anti‑abuse systems.
If you are in a high‑risk role, consider using a separate number for WhatsApp that you do not share widely, keep your profile photo set to Nobody, and let only trusted people see your About and Status. It is not perfect, but it cuts exposure a lot.
Bottom line. The researchers showed that WhatsApp’s contact discovery can be abused at huge scale if rate limits are weak, and that profile privacy choices really matter. Meta says it uses limits and that there is no sign of broad abuse, but you do not have to wait on anyone to be safer. Flip the switches above and keep your circle tight. It takes a minute, and it pays off every single day.
References to official guidance:
- WhatsApp Help Center: About privacy settings and who can see my information
- WhatsApp Help Center: Two‑step verification
- WhatsApp Help Center: Silence unknown callers
- WhatsApp Blog and Help Center: End‑to‑end encryption and Protect IP address in calls
Also Read | Wikipedia to AI: use the Wikipedia API and stop scraping
Source: WIRED
