News · New this week
WhatsApp profile photo and name are not proof of identity
A familiar photo and a name like Boss are just data anyone can set. The phone number is the only identity WhatsApp has.
An interviewer might ask you this: the message has your boss's photo, so why can it still be fake? The answer is a system design point about what an identifier is.
What WhatsApp actually identifies
WhatsApp's identity is the phone number. That is the key for the account. Everything else on the profile is attached data.
The display name is free text. The photo is any image. Nothing in the flow checks that either one matches a real person. A scammer can use their own number, set the name to "Boss", upload a photo, and the profile looks right.
So a photo and a name are labels. They tell you what the sender wants you to see, not who the sender is.
What the OTP proves
The obvious objection is that WhatsApp verifies the number. It does. A code arrives by SMS, the OTP, and entering it shows that the person controls that number.
That is a proof about the number. It says nothing about the human behind it. The status for a scammer's account reads something like "OTP verified, person unknown". The number is real, and it still belongs to the wrong person.
What shows up on your phone
Follow the flow. The scammer sends from their own number. WhatsApp routes it by that number. Your phone then shows the message.
If the number isn't saved in your contacts, your phone shows the number, with the name in small text as a label. Your real boss is almost certainly saved. An unsaved number claiming to be them is the red flag.
That's the check worth making. Look at the number first and the name second.
How to verify before you act
Don't ask the sender to confirm in the chat. The chat is the scammer's channel, so the scammer will answer. A reply of "yes, it's me" tells you nothing.
Go around the chat instead. Call the number you already have saved for your boss. That reaches the real person, and the scammer isn't in the path.
This matters most when the message asks for money. A request for payment is the moment to stop and call back.
The short version
Number is the identity. Name and photo are labels. If a message with a familiar face asks for money, call the saved number before you do anything else.
Next time a message from "Boss" lands, check whether the number is saved. If it isn't, call the one that is.
