I am not used to writing short articles, and perhaps neither are you expecting one. Let’s both pretend that (a) I can write succinctly, and (b) I can make it worth the read.

So AI, huh. Insanely scary, but also dumb as my cat sometimes. Like everything nuanced, its abilities lie on a spectrum (at least for now). One end is where the skeptics lay eggs, and the furthest end is where the hypeists believe that AI will soon prove “Why is 42 the answer to life, the universe, and everything?”.

As a common man, I stand somewhere in the middle of the spectrum. Truly skeptical about some parts of it, truly mindboggled at many other parts. This is a brief story of one use case that keeps giving day in, day out for me.

Building software now, I’ve gained a weird superpower that feels obvious on day one of GPT being released but not so easily proven when moving from theory to practice. The superpower is that I went from carefully picking one path at a time to exploring five paths at once. It feels like going from high-stakes betting to low-stakes experimentation. AI gave me what I’d call “cheap optionality” (the term exists somewhere, but I forgot where I read it before). It is the ability to explore the problem and solution spaces without committing to one of them at a time, and to do so cheaply. Let me explain what I mean.

Before, making a technical decision or solving a problem felt like standing at the base of a massive decision tree, where every fork from root to leaf required careful pondering (and this kind of pondering hurt me the most, because I tend to bias for action). I’d spend enormous mental energy trying to predict the optimal path; which branch, which sub-branch, all the way down through diminishing tributaries to a single solution. It was exhausting because many times choosing wrong meant backtracking through the entire flow chart, losing hours or days retracing my steps. Or worse, I commit to the wrong path because it is too late and I can make it work now, and fix later.

When I used to work at Intercom, I learned to counter this via brutal scoping, but even that was best effort and often ended badly.

Now, with LLMs, I can send scouts down multiple branches simultaneously. I can explore five different paths to the edge leaves, compare their fruit, and either commit to the best one or synthesize insights from several. The tree hasn’t changed at all. It’s just as vast and branching; but I’m no longer paralyzed at each fork, agonizing over irreversible choices or crying at how my bias for action and impatience hurt me. Basically, what happened is that the cost of exploration has collapsed, and with it, the anxiety of having to ‘get it right’ on the first try. Finally, I can try as much of the tree traversal I can navigate, and as much in parallel as I can. The bottleneck starts to appear at the end of the day in the form of my brain actually being overloaded.

Turns out there is an actual concept in computer science that describes this: design space exploration.

Take the “contact matching” feature I built recently matching HubSpot contacts against a third-party system that only stores phone numbers. The goal is that I need to find a way to reliably match a HubSpot contact with the 3rd party equivalent contact, and the only reliable identifier we have is the phone number.

At the root, I faced the fundamental question (which I know from experience is a pain in the ass): what’s the contact matching strategy? Do I normalize phone numbers first or match raw? Each choice branched into sub-questions. If I normalize, which format? E.164? National? What about extensions and country codes? If I match raw, how do I handle the inevitable mismatches from different formatting conventions?

Then came the next layer: collision handling. What happens when one phone number maps to multiple HubSpot contacts? Do I match on most recent activity? Primary vs. additional phone fields? Create a manual review queue? Each approach spawned its own complexity tree; confidence scoring systems, fallback hierarchies, data quality checks.

Before LLMs, I’d spend hours paralyzed at each fork, trying to predict which path would dead-end three branches deep. Choosing ‘normalize first’ felt irreversible. If I later discovered I needed raw matching for certain edge cases, I’d have to backtrack through the entire decision canopy, rewriting logic, tests, and product decisions I took along the way.

It is somewhat different now. I send the LLM scouts down (I like to make them work; it is not cruel) multiple branches simultaneously. I’ll start three LLMs doing a deep research on all contact matching literature, all algorithms, all ways people made it work, and any number of complaints users would have online of such systems. Then I’d have one conversation exploring phone normalization libraries and their edge cases. Another prototyping collision resolution with a fuzzy matching approach. A third investigating HubSpot’s API limitations around phone field queries. Within a couple of hours, I’m comparing actual implementations at the leaf nodes rather than anxiously theorizing at the trunk. Let alone actually taking those and letting cursor go wild implementing solutions, and I review.

It feels as if I gained the superpower of time travel where I keep jumping between those tree branches and sub-sub-sub branches at extreme speed, seeing all the possibilities, and picking the right one.

This truly fascinates me because the tree is the same. It’s just as vast and branching, but I’m no longer paralyzed at each fork, agonizing over irreversible choices. The cost of exploration has collapsed, and with it, the anxiety of having to ‘get it right’ on the first try. I can walk five paths, see which ones look more likely to work, and synthesize the best hybrid approach instead of betting everything on one early decision.

When you join or start a start-up, you will feel everything seems to be breaking most of the time. A thousand things to get done. Endless work. Endless hustle. You will learn to embrace this feeling. Lucky for you, not all broken things are equal. Not all requires your attention now. 10 out of 1000 things are the most impactful to fix now. Everything else is secondary. Everything else is not worth the attention or the anxiety. Attention is precious and your credit of anxiety should be deferred and spent wisely.

• You will feel lonely.

• You will be ignored initially.

• You will be rejected by investors.

• You will be rejected by prospects.

• You will get phones hanged up on you over cold calls.

• You will have 1 lonely like on your thoughtful Linkedin posts.

• You will write, and re-write your product.

• You will build crap no one wants.

• You will sell your product for so cheap, because YOLO.

• You will have frustrated and angry customers.

• You will get rude customers.

• You will lose deals for reasons out of your hands.

• You will deploy code that breaks your product.

• You will build a crappy interview process.

• You will hire the wrong people.

• You will hire the wrong people, again.

• You will have to wake up at 2 am to take a sales call.

• You will have to onboard a customer at 11.34 PM.

• You will have your best engineer resign to join a big tech co.

• You will get rejected (possibly laughed at) when trying to hire a FANG engineer.

• You will underestimate the time it takes to close deals.

• You will overestimate your product's market fit.

• You will pivot multiple times.

• You will second-guess your decisions.

• You will have churning customers.

• You will have to be a great vision communicator.

• You will need to run your first all-hands.

• You will need to inspire, motivate and lead.

• You will have to let go of genuinely nice but unfit people.

• You will burn out. Then burn out some more.

• You will have to manage conflicting advice from who-have-done-it-before.

• You will have to negotiate with difficult suppliers or partners.

• You will underestimate the complexity of seemingly simple stuff to build or do.

• You will hire someone who looks perfect on paper but is a culture nightmare.

• You will have to fire someone within their first month.

• You will underestimate the time it takes for hires becoming productive.

• You will have sleepless nights of fear and loneliness.

• You will have to be really good at sales.

• You will keep scratching your head to what marketing really is.

• You will keep saying demand gen 100 times every day.

• You will worry about competitors.

• You will scratch your head of users behaviour using your product.

• You will suck at running product research sessions.

• You will say no to a lot of things that you want to say yes to.

• You will get hoards of fake "consultants".

• You will fight for 2 pixel margins.

• You will feel like things are going 1000x slower than it should.

• You will not earn as much as you can.

• You will be good at cutting through bullshit.

• You will get angry, and regret it.

• You will be expected to set the bar.

• You will be expected to be the role model.

• You will have really tough days, and other fantastic days.

But you will continue. You will persevere. You will keep going.

Because what else is worth doing? What else will raise the bar for what you can do with the little time you have on this earth? What else will make you see the fullest of your potential?

This is the most selfless bet you can take. This is the shortest way to truly understand and know yourself. This is a journey of self discovery, self honesty, and self understanding. This is a journey of zero tolerance to bullshit and mediocrity. This is a chance to see yourself as is. Raw, and bare. The good, the faults, the weaknesses, the unique, the superpowers, the whole lot. ✌🏽

I'm not affiliated with Meta or WhatsApp. The views and opinions expressed below are my own and do not reflect those of any company or organisation. I do not endorse, encourage, or support any method of tampering with, tweaking, or modifying any of WhatsApp's copyrighted material, products, or brand.

Introduction

Did you know that around 50% of all emails sent each day are spam? 162 billion spam emails worldwide, every day, out of 333 billion. Humans have been subjected to all forms of spam from as early as 19th century junk mail (or even earlier), to social messaging spam and many novel forms today. Spam comes paired with any communication channel humans use – WhatsApp included.

Spam is but one element under the umbrella of platform abuse. Any communication channel that reaches mass usage or has a significant population is subject to different kinds of abuse, for plenty of reasons. This is the equivalent of the eternal competition between armor and sword. Abuse tactics vs abuse prevention. I am confident that you know what abuse (e.g. spam, theft) looks like through phones, SMS, emails, social media, and social messaging apps.

Hell, I even came across a spam message from 1864 – a dentistry "advertising" their opening through a spammy telegram to a politician. Two words: mind blown.

If you’re building a business over WhatsApp today – whether you’re a product builder offering a service, a business owner using WhatsApp to run your operations, or an investor investing in a WhatsApp-based company – you need to clearly understand the risks of abuse on your business. Specifically, when it’s accidental and unknowing abuse. You need to know what you don't know that you don't know.

In a few short acts, I will take you through a tour of the sword vs armor in the communication realm – particularly within the kingdom of WhatsApp. You will understand:

1. What is platform abuse in WhatsApp and why you should care

2. Each of the forms of abuse, and how it affects your business, and finally 

3. What to do to avoid it. 

There will be entertainment and drama – this I can promise. Let's roll.

Act I: Sword & armor

A billion dollar question

100 billion messages & 100 million voice calls are sent over WhatsApp daily. I’m confident that spam on WhatsApp isn't as bad as email (for a variety of reasons). Looking at today's email spam rate, you can imagine the potential trend if abuse isn’t well fought on WhatsApp. 

At the most fundamental level, WhatsApp's core benefit is staying connected with people who matter to me, and they matter most to me because I trust them the most. Trust is the bedrock of meaningful relationships, and these are the people we communicate most openly with. 

I urge you to think about the following for a moment: Can you describe what WhatsApp fundamentally sells or offers, in one word?

WhatsApp sells trust. Not communication. Not connection. Certainly not an app. They sell trust. It is that you wake up every morning with enough trust that the most stable, convenient, secure, reliable, spam free, most *insert whatever* way to connect with those who matter to you is WhatsApp.

Most importantly, you trust that your important people are hanging out there, too.

I can bet you that the WhatsApp leadership folks wake up everyday thinking about how to protect their most important value proposition (p.s. I dislike the word value proposition to describe what's happening here – I call it the core job-to-be-done instead).

I look back at all the decisions WhatsApp made in their product over the years, and I see one clear pattern – the show must never stop, not even for a millisecond. Because if it stops, trust decreases rather quickly. All their decisions are around keeping the app running at all costs. Simplicity in product design, reduction in features compared to competitors, and a laser focus on getting a few core functions right instead of a hundred half-baked ones – these are all intentional decisions. These choices are to keep the app's purpose crystal clear; the app just works.

Want proof? A few years ago, false information was circulated about WhatsApp’s end-to-end encryption potency, leading flocks of people to move to Telegram and Signal. I mean, TELEGRAM! A messaging app on which you can literally build a custom client from scratch, sitting between you and their servers, and that can store every single message passing through – in plain text. It is a subpar channel compared to WhatsApp, but people didn't care at the time. They decided that WhatsApp broke their trust, and that any alternative, no matter how bad, was better than that.

The ways of abuse

I have a personal definition of abuse for messaging apps that’s simpler than most. Abuse is any activity that undermines WhatsApp user trust. That’s it. Yes, there can be intentional or unintentional abuse, but it’s still abuse. It still eats away the user's trust in the platform.

Abuse, and in particular spam, isn’t new to WhatsApp. Once a platform reaches mass usage or has a significant population, the abuse will appear, and consequently, the platform starts building defences. WhatsApp likely started taking spam seriously around 2013; maybe earlier. I expect that the 200 million active users mark is where they had some form of anti-spam effort dedicated to fighting abuse.

The abuser and the platform are in a continuous, constant fight of sword versus armor. As Matt Jones, who led the anti-spam engineering team at WhatsApp, eloquently put it in his talk:

... If it costs them 11 dollars just to make 10 dollars, they're not going to stick around for very long. So as we're trying to build detection mechanisms and new approaches, we have to think about this and say “how does this new approach make life more expensive for spammers?” ...

Abuse over WhatsApp happens in three different ways: 

1. Security vulnerabilities

2. Reverse engineering

3. Exploiting logical gaps or poorly designed features

Most of the abuse comes through the reverse engineering approach. This is the act of breaking apart the components of a software (like WhatsApp), understanding how these components work together, and emulating or tampering with them to work in other ways for the benefit of the owner.

Sometimes, we reverse engineer software or hardware for non-malicious motives. I once had to reverse engineer the protocol of my digital camera to make it easier for me to transfer photos to my computer. Reverse engineering for convenience is real, and it happens. However, most of the time, reverse engineering opens the door to malicious motives, especially if the incentive is high enough. 

This entire category of abuse is possible through what I label as 3rd party enablers. We will zoom in on 3rd party enablers for the rest of this article – who they are, why they exist, what they do, the harm they cause, and most importantly, how to detect and avoid them.

3rd party enablers

A 3rd party enabler is a non-official actor that modifies or replaces the official way of using WhatsApp for a certain benefit. Every single 3rd party enabler on the internet uses one or more types of reverse engineering approaches. Some are built purely for abuse, some for convenience, and some are just for fun. I will go through each method for both your entertainment and awareness. 

One thing is certain: all of these methods eventually lead to conflict with the platform in various ways, which we will explore in Act II.

There are three main types of 3rd party enablers, each crazier than the other.

A full-fledged client (headless, or UI-based)

Back in 2018, I stumbled upon one of the first WhatsApp-API-as-a-Service providers, which was a reverse-engineered version of WhatsApp exposed as an API. I dabbled a little in WhatsApp Web myself, and it wasn't too hard to get something working, emulating the way WhatsApp worked, or exchanging a few messages. I contemplated whether or not I should build a business on this kind of API provider, but quickly realized that it would turn into a dark weapon for abuse, and wouldn’t be sustainable (and indeed, they shut down and came back up a few times).

Crazy as it sounds, WhatsApp was hit by a flood of fake clients some time ago (and some are still alive today). The likes of WhatsApp Plus, WhatsApp Blue, and many others. There is an official WhatsApp page dedicated to warning about unofficial apps. Actors who offer these clients reverse engineer how WhatsApp works (usually through the web), and build an app (usually an Android, iOS, or web app) that emulates all of its functionality. In doing so, they can offer extra functionality that's not possible through the official apps.

There is also the headless version, which is a piece of software that runs on a computer (usually a server), allowing all kinds of automations and abuse, such as bulk messaging, and more.

Usually, actors reverse engineer the way WhatsApp works by looking at how WhatsApp Web works. Even if there wasn’t a version of WhatsApp for the web, this wouldn’t stop bad actors – they’ll just do that with the standard apps instead.

An emulated client (virtual, or physical)

Because the above isn't crazy enough, here’s some more crazy soup for you. Some years ago, and probably still running now, there was what I call a virtual WhatsApp farm.

Imagine hundreds, if not thousands, of Android emulators running simultaneously on many servers in the cloud (or on-premises), choreographed to each run the WhatsApp Messenger (or Business app), and each with a registered virtual number of its own. The actors would warm them up for a few weeks, messaging each other and other numbers that aren't yet involved in malicious activities. They would use Residential VPN services to keep the IP addresses dynamic. 

The goal of the warm up phase is to behave like any other standard WhatsApp user–adding a few connections, messaging, and so on. Then, they unleash the dirt, whether it’s a massive scam, personal info theft, advertising, or any other money-making scheme. A virtual, scalable abuse farm.

You get the point. 

Yes, there’s also a version of this that’s a physical phone farm. Literally hundreds, if not thousands, of mobile phones behaving like I described above, except they’re physically accessible. I'll let you visualize the rest.

A browser extension

The last type is my arch enemy (not literally; I don't yet have a list of arch enemies, but when I do, I will write an article about them). Even though the types discussed earlier seem dangerous and destructive, this type is usually what brings harm to businesses, because it’s disguised as playing nice and as a convenient way to use WhatsApp for business. But in reality, it is the very opposite.

You know about WhatsApp Web, right? This type of enabler is a browser extension (for Chrome or Firefox) that runs on top of your WhatsApp Web. It usually helps you do things more efficiently, and makes WhatsApp even more convenient to use – often for business purposes. This sounds good and helpful, right? WRONG. This gets your account banned. But why? You might be tempted to think, “well, it doesn't sound fishy. It just compliments WhatsApp's functionality, and it runs in the same browser where I’m using WhatsApp Web. It’s just more convenient”. Again, wrong.

This type of browser extension has the ability to eavesdrop on everything you’re doing on WhatsApp. How? They have access to your browser tabs, including your WhatsApp Web tab. There is little or no way to add control or limit their access once you install the browser extension. Your media and your chats (both work and personal, incoming and outgoing) are like an open book. By sitting between you and WhatsApp's servers, these extensions can potentially access all your messages, contacts, and other sensitive information. 

The core distinction between a browser extension and the official WhatsApp Business API is that a browser extension is uncontrollable. It doesn't have to operate within the rules. It also has access to way more information than official WhatsApp providers do (profile pictures, other private or non-work chats, etc.), and even access to other tabs if it wants to.

I’ve built two businesses over WhatsApp in the last 6 years or so, both on top of the WhatsApp Business Platform. I got to see my fair share of all kinds of eccentric WhatsApp setups. During these years, I spoke to thousands of customers using WhatsApp for their business every day. I collected data from 1760 customers and looked into the top reasons businesses face issues when using a 3rd party enabler. The majority of the account bans happened due to browser extensions. It became clear to me over the years that browser extensions, while not very sophisticated in their abuse or even malicious, can have the worst impact.

By the end of the next act, you will be an expert in the dos and don'ts of WhatsApp. You will be able to run a business reliably over WhatsApp without risk, make the right technology choices when building a business on top of WhatsApp, or know what you’re getting into before investing in a WhatsApp business that's destined to crash and burn.

Act II: Cost of abuse

This talk and WhatsApp's own whitepaper (titled “Stopping abuse: How WhatsApp fights bulk messaging and automated behavior” which you can find linked here) sheds some light on how WhatsApp fights spam.

Every month, over 2 million WhatsApp accounts are banned for bulk or automated behavior. Machine learning systems detect and ban suspicious accounts at registration, during messaging, and in response to user reports. WhatsApp analyzes account information, IP addresses, and carrier data to detect bulk registrations, and during messaging, WhatsApp monitors account activity patterns and behavior to identify automation and abuse.

Besides this, user feedback (reports & blocks) is used to evaluate accounts and improve detection systems. WhatsApp also limits group sizes and message forwarding to reduce the spread of bulk messages.

They analyze hundreds of factors to differentiate between normal and abusive behavior. Finally, WhatsApp works with providers to ban third-party apps that claim to offer unauthorized services for the platform.

Every time a 3rd party enabler modifies or tweaks or replaces the official way of using WhatsApp – the account is at risk of getting banned. This includes 3rd party browser extensions, and others.

The Happiest Folks Inc.

The Happiest Folks Inc is a made-up business, but one that I have seen real life examples of over the years. They run their operations online, and WhatsApp cuts horizontally through their business, whether in sales, support, onboarding, success, or marketing. 

At the start of their journey, being a tiny little company, they happily used the WhatsApp Business app, until they outgrew it. They needed to do more. They hired more people. They implemented a CRM. They wanted to measure performance. They wanted to automate. They started looking for ways to scale their operations over WhatsApp, and to deal with the high volume of conversations more efficiently. 

Unfortunately, they chose what's seemingly convenient and cheap over what's reliable, scalable, and trustworthy. They asked their sales, support and success agents to install a browser extension (3rd party enabler) that works on top of their WhatsApp Web. The browser extension used unofficial APIs to get things done. It was convenient, but only in the short term. A few of their agents noticed that their accounts were getting banned, some of their automations stopped working, and their marketing team couldn't spin up campaigns over WhatsApp anymore. Some of their customers could no longer contact them.

A while later, their 3rd party enabler (the browser extension company) was hit by a security breach leaking all their customers’ personal information. They kept going. Eventually their 3rd party enabler was shut down due to a DMCA notice like this one. They were left out in the open and had a reputational crisis to deal with. 

Their management understood that the way to go is to switch to the WhatsApp Business Platform – a wise decision that should’ve come sooner. Better late than never.

Legality & liability

I am not a lawyer, a legal expert, or have any background of this sort, but it’s not hard to decipher or understand where trouble is, and more importantly, how to avoid it.

It is clear cut in Meta's policy on the Unauthorized use of automated or bulk messaging on WhatsApp:

Any browser extension that enables abuse that violates WhatsApp’s Terms of Service, like automated or bulk messaging, is at risk. Notice that it is not just bulk messaging, but also any kind of automated messaging. A browser extension like the one below that can broadcast or automate messages on your behalf falls right within this category. I have seen countless instances of accounts getting banned because of this.

By using these tools, you are leaving it to others to decide, on your behalf, how to get around WhatsApp's own machine learning algorithms for detecting misbehavior or abuse.

DMCA

More than just violating WhatsApp’s terms of service, there is also the DMCA risk. This is a real life example of it in action, with content hosted on Github that causes harm to WhatsApp.

The DMCA (Digital Millennium Copyright Act) is a U.S. law that helps protect copyrighted works by allowing copyright holders to request the removal of infringing content from the internet. WhatsApp, whose software is protected by copyright and trademarks, found a few years ago that some developers had reverse-engineered its software and uploaded versions or tools related to it on GitHub. Examples include projects like WhatsAPI and node-whatsapp. To protect its intellectual property, WhatsApp sent a DMCA takedown notice to GitHub. After reviewing the request, GitHub agreed that the listed repositories were infringing on WhatsApp's rights and took them down.

WhatsApp used the DMCA to remove unauthorized projects from GitHub, safeguarding its software and trademarks.

The 3rd party enablers use technology that's built on these OSS (open-source solutions) reverse engineering attempts to grok how WhatsApp works, so you can imagine the impact on those companies. They will practically shut down the very next day after a DMCA takedown happens.

Reverse engineering

At the far end of the abuse spectrum, there is the infamous case of the government-backed NSO group for reverse engineering WhatsApp. Abuse can happen through malicious and secretive forms, and reverse engineering is at the root of the most sophisticated and coordinated methods. It is also the most expensive. There'd be at least a few teams working on spyware like Pegasus, and tens of millions of dollars spent on some of the hardest computer security problems to ever exist. 

This may seem gibberish to non-technical people, but in short, the spyware contains multiple zero-day vulnerabilities against a particular version of iOS. The purpose is to override and install a man-in-the-middle spyware to intercept, record and transmit messages from messaging apps on the device, and forward it to the abuser's servers.

Orchestrating and stringing those vulnerabilities is extremely hard, but the consequences can be as big as bringing governments down, knowing how deeply penetrating and foundational some of the messaging apps on the market today are. Imagine by knowing someone's number, you can send them a link that gives you immediate access to their messages, calls and everything that's happening on the device. Sometimes the link doesn’t even need to be clicked.

The gist here is that any form of reverse engineering is going to be at least in the gray area, if not worse. It is simply not worth it to build a business or a product on top of a gray area – and especially if there’s a better route.

Reliability & high performance

There are different types of risks within the communication sphere, and any business owner has to think about ways to mitigate these risks. There are two primary risks that you need to consider: service disruption, and scalability limitations.

Service disruption: It is anything that compromises your ability to do business on a daily basis. If you’re using WhatsApp today, or your business is built on top of it, the most severe risk is the inability to use or communicate with customers over WhatsApp. A total service disruption.

This can happen if:

• Your account is banned

• Your provider (such as a 3rd party enabler) is unreliable

• Your provider closes shop or faces legal issues

Scalability limitations: it is about outgrowing the current method of communication. Your business has scaled, but your method of communicating with your customers stopped scaling with your business. Worse, you can't replace the channel of communication because that's where your customers are. You’re stuck. You start to lose money because you’re dropping opportunities left and right.

This can lead to:

• Inefficient operations

• Missed opportunities (e.g. dropped leads, lost deals)

• Poor customer experience

Reliability

A reliable messaging experience is one where sending or receiving messages just works. We take it for granted that if I send a message to my friend over WhatsApp today, it will be delivered. Tons of effort and time go into making this happen in the background. Tampering, tweaking, or replacing the behaviors of a product removes the guarantee that it will be a reliable messaging experience.

When you use 3rd party enablers (e.g. browser extensions or unofficial APIs), you face two core issues: 

• Account bans

• Messages delivery issues

Account bans

Early in this act, we went through how WhatsApp analyzes hundreds of factors to differentiate between normal and abusive behavior. When you use a 3rd party enabler, you are under the mercy of how the 3rd party behaves or emulates WhatsApp's own behavior. Most don't do a good job at that. 

Any reverse engineered version of WhatsApp has one important goal: to simulate the way WhatsApp works in the closest fashion possible, so that it appears as a genuine client (WhatsApp Web, or the WhatsApp Messenger on iOS, Android, or any other desktop OS). If there is a slight misalignment on how they emulate the way WhatsApp clients work, WhatsApp will and can detect that through metadata analysis.

There are countless cases like the above, all over the internet, that detail this behavior. The case in this screenshot involves a GitHub issue in a reverse-engineered WhatsApp Web repository used by many third-party enablers. It is not that these types of solutions are malicious by intent, but it is a difficult and risky job to keep their versions in line with how WhatsApp works. Eventually, this risks accounts getting banned because these workarounds simply can’t keep up.

Message delivery issues

There are different types of 3rd party enablers as we covered earlier. Some assume complete control of the sending and receiving of messages, and sometimes all other operations within your WhatsApp experience. This is what we refer to as a full fledged client (headless, or UI-based). A browser extension might not necessarily do this.

What's important to know is that this type of 3rd party enabler would, in essence, emulate the functionality of your WhatsApp Messenger or WhatsApp Business app. You lose the guarantee of the messaging experience, because you hand it over to them.

You're effectively transferring your trust from WhatsApp's experienced engineering team to an unknown group of developers. WhatsApp's team has built and refined the messaging experience from the ground up. They understand every nuance of the system and are committed to its reliability. In contrast, 3rd party developers are reverse-engineering this complex system, often without full understanding or the resources to maintain it at the same level of reliability.

This directly impacts my trust in whether a message I send will actually ever reach my customers. Will I know if it never gets delivered? What do I do when it doesn't?

–

WhatsApp introduced their WhatsApp Business Platform (APIs) to offer businesses a reliable way to run their operations over WhatsApp as they scale. Long term commitment and reliable foundations are what you get using the official APIs. Meta has visibly put in significant effort and long-term organizational commitment around their WhatsApp Business Platform. Compare this with the unofficial APIs – if you are using a 3rd party enabler, you are likely just one step away from having a service disruption.

High performance

When your business is scaling, you want guarantees that your technology choices can scale with it. WhatsApp is a messaging service, so sending and receiving messages is core to the experience.

High performance in WhatsApp communication means:

• Speed

• High volume handling

• Platform guarantees

Speed

Imagine you’re operating a B2C business selling baby strollers where parents would interact with you to ask questions about a certain stroller, and your messages, instead of arriving instantly, take a few seconds or a minute to arrive.

The parent has many questions about your product. It’s a back and forth conversation. There is a lot of interaction, including small touches of relationship building. You are, by the choice of technology (your 3rd party enabler), subject to receiving messages later than you should. You’d lose your prospect to a competitor who responds faster than you.

Plenty of issues like the above occur when trying to figure out a way to emulate how WhatsApp works. It is a never ending cycle of back & forth hacks, workarounds, tweaks just to get the basics to work (basics which are readily given and guaranteed by the official methods), all for what may be a small gain in convenience or functionality that a 3rd party enabler promises.

High volume & platform guarantees

Using a 3rd party enabler potentially risks one more guarantee when your messaging volumes start to ramp up. But why? Isn’t it just based on the existing WhatsApp products?

Any 3rd party enabler can modify, tweak, or replace the WhatsApp Messenger or Business app’s default behavior, which can intentionally or unintentionally affect the experience of sending and receiving messages.

Think of your messaging needs as powering a factory. The WhatsApp Business Platform is like the main power grid: stable and capable of handling high demands. 3rd party enablers are like rewired generators, they might work for small operations, but they're risky. These unofficial modifications could lead to sudden failures, similar to how 3rd party enablers might trigger account bans or be the cause of unreliable performance. The grid reliably delivers 1000 kilowatts, while the modified generators struggle past 100 and could fail unpredictably.

The WhatsApp Business Platform (API), as of today, allows you between 80 messages per second by default (4,800 per minute) and up to 1,000 messages per second (a staggering 60,000 messages per minute)! In this world, you’re unlikely to reach these limits. 

You are guaranteed that the core messaging integrity is maintained, and you have a direct connection to the source system. No tampering, no tweaking, no replacements. It just works.

API FOMO

API fear-of-missing-out is real. The WhatsApp Business Platform (API) is like a fully functional remote control with infinite buttons. Giving up on using official APIs is like giving up this remote control for a 3-button analog controller with buttons that only work half the time. It’s unreliable, limited, and you miss out on many opportunities. More importantly, there’s no strong reason to make this compromise.

WhatsApp has three products in the market today: the WhatsApp Messenger, the WhatsApp Business app, and the WhatsApp Business Platform (API). Any 3rd party enabler (browser extension) runs their unofficial methods either on the WhatsApp Messenger or the WhatsApp Business app. Most new features or updates to the WhatsApp Business Platform (API) will likely never be available to you if you don't use the official APIs.

The WhatsApp Business Platform today has features that don't exist on the WhatsApp Messenger or WhatsApp Business app. Even more so, WhatsApp just announced that the WhatsApp Business Platform will offer Voice (or Business Calling) and Groups as an API, which are drastically different from the voice and groups features offered in the WhatsApp Messenger or Business app, as they are programmatic and open up an infinite set of possibilities and use cases. 

You also miss out on higher customer engagement rates. How so? WhatsApp has introduced all kinds of interactive messaging components. Text is good in many cases, but it’s much easier to click a button, fill out a quick quiz, send a location, or select an item from a list. Every time the user has to make a choice when interacting with you, they’re going to choose the easiest option.

Using a browser extension or a 3rd party enabler takes that power away from you, and the experience away from your users. No 3rd party enabler today can allow you to send buttons, quick replies, lists, forms, or other types of engaging content over WhatsApp. CTAs work for a reason; they increase engagement, and eventually conversion.

Your business is going to be as successful as the investment you put in it, and a big part of this investment is technology. Any unofficial 3rd party enabler, like a browser extension, will always play the catch-up game with the official ways of using WhatsApp for business – a catch-up game of hacks and unreliable emulation.

Scalability ceiling

If you're starting to use WhatsApp for your business today, you can either use the WhatsApp Business app, or the WhatsApp Business Platform (API). A small business, like a flower shop that has 1 or 2 employees, would most likely go for the WhatsApp Business app, and it is the right choice. Larger businesses that run their sales and/or support operations over WhatsApp with tens or hundreds of employees interacting with customers are unlikely to go for the same choice as a small business.

But why? It’s simple. Their operational needs outgrew their customer engagement method.

Imagine a situation outside the context of WhatsApp. You are a small business, you have 1 sales person who uses their personal phone to call & respond to your group of 20 loyal customers. Things work out, you hire more sales folks, they follow the same method. You have a team of 5 salespeople, and all of a sudden, you start noticing gaps. You need to record your calls and review them with your team, coach and train those folks, set up IVR, assignment calls, and have voice mail recorded per salesperson. To achieve all this, you end up using a cloud phone system like Aircall. 

You’ve outgrown the old way and need to scale up your processes and tooling.

Using a 3rd party enabler (e.g. a browser extension), which in turn is built on top of the WhatsApp personal business app, can help you scale to a limit. The more you grow, the closer you are to outgrowing your processes and tools.

Ask yourself the following questions:

• Can we efficiently manage and track high volumes of customer conversations for multiple agents without compromising security or control?

• Is there a way to integrate our WhatsApp communications with our CRM to eliminate manual data entry and ensure real-time data synchronization?

• How can we implement a system for easy assignment, collaboration, and handover of leads or deals between team members and across functions?

• Can we monitor and improve agent performance based on their WhatsApp interactions, and maintain accountability for lost leads or deals?

• How can we ensure data ownership, continuity, and compliance with regulations as we scale our WhatsApp operations, especially when team members leave the company?

As your team grows, saving their time and letting automations kick-in is a big deal. I recently stumbled upon a team of around 50 sales people in a business. They all use their personal WhatsApp. At the end of each day, they spend 5 to 10 minutes per prospect taking screenshots of their WhatsApp conversations and uploading them to the CRM. Each person does this for about 10 prospects per day, up to 20 in some cases.

50 salespeople x 10 prospects x 5 minutes = A staggering 2,500 minutes, or 41 hours wasted EVERY SINGLE DAY. 

This makes zero sense. It’s 100% automatable. 3rd party enablers or browser extensions built on top of WhatsApp try to automate this but fail miserably – they’re unreliable, and the risks are not worth it.

What's the answer? a well-built, reliable, two way sync using the WhatsApp Business Platform to cater for scale and automation.

Security

Imagine you're sending a private letter through a trusted mail service, but instead of a direct delivery, you hire a person who promises you not to open and read your letter before passing it along, and promises that the letter will be delivered. It is hard to trust just a promise. This is like a browser extension built over WhatsApp, potentially intercepting, and even storing a copy of your private messages, turning a trusted communication into one based on a promise.

You may be asking yourself, doesn’t every other provider, even the ones built on the WhatsApp Business Platform, offer more or less a similar promise?

I will elaborate on how and why these promises are radically different and come with completely different guarantees.

Tampering & modification

WhatsApp has built-in end-to-end encryption for all kinds of messages, media, calls, and other types of communications that happen over their apps or platform. 

A method WhatsApp recommends is to use Code Verify to check if your current version of WhatsApp Web has been tampered with, modified, or has the end-to-end encryption guarantee broken. I always turn it on whenever I install a new browser extension that may affect my personal WhatsApp Web.

WhatsApp's own documentation warns and recommends against using any browser extensions to ensure the security of your messages.

Why?

Browser extensions can't avoid failing this verification test. Code Verify (an open-source tool) operates by comparing hashes: it checks the hash of WhatsApp Web's code against the hash generated when an extension is active. If the extension tampers even one bit with the current page’s code (which it must do to inject its own scripts, UI layer, etc), then Code Verify will signal a verification failure. 

There’s almost certainly no way around it.

If you truly want to vet a browser extension, you need to research who created the extension, what their policies are and, just generally, whether they’re considered trustworthy. The effort spent on vetting a browser extension is an opportunity cost. This time and effort could be better spent on using the official WhatsApp Business API.

And for headless clients that completely replace your WhatsApp client’s experience, the tampering and modification risk is just not worth it. They have 100% control of what goes on. There is little to no visibility into the experience.

Opaqueness

When it comes to security, vetting a 3rd party enabler (whether a browser extension, or a headless unofficial client or API) is about visibility and evidence-based guarantees. The lack of guarantees of how the 3rd party enabler works creates a situation of opaqueness on how it operates, and whether it is trustworthy or not.

This vetting process can be complex, and most businesses are ill-equipped to handle it. While the source code may sometimes be publicly available (as with a browser extension), thoroughly inspecting and analyzing it requires significant technical expertise and time. Going through someone else's obfuscated code is a challenge, and worst of all, the code can be updated the day after your initial inspection, rendering your efforts useless.

Unlike the WhatsApp Business Platform, your vetting process for a 3rd party enabler (specifically a browser extension) starts with evaluating the vendor at the browser level. You are scrutinizing not just their systems but also their distribution method. A vendor building on top of the WhatsApp Business Platform will always work within the rules and boundaries of how the platform is designed to be used—what's possible within it, what's not, what's safe, what quality looks like, and so on. You won't have to worry about issues like malware being distributed as part of a browser extension that can leak or inspect data even beyond the WhatsApp Web experience. This is one of the many risks that exist with using a browser extension.

Another exercise: go through the top 10 WhatsApp browser extensions in the Chrome Web Store. How many of them have security compliance, like SOC or ISO? Credibility of the company or developer is another flavor of opaqueness. There is no easy proxy for you to trust the developers behind a 3rd party enabler you give access to your most trusted business-to-customer communication. At the end of the day, they have open access to your browser.

There are plenty of examples around potential damage, whether intentional or unintentional, that can happen. Unfortunately, this may have less to do with the 3rd party enabler and more with the inherent risk of browser extensions as a distribution method. Kaspersky's research illustrates how they found malicious browser extensions with more than 87 million downloads!

Finally, I’m not saying all 3rd party enablers are malicious—some aren't. Some have some form of compliance certification, such as SOC or ISO. The problem, even with compliance, is that it’s hard to discern what they can or can’t do, and ultimately, which ones are trustworthy, and which aren’t.

Act III: Armor

3rd party enablers = bans

The guts of the problem is that a 3rd party enabler modifying, tweaking, or replacing the WhatsApp Messenger or Business app can, intentionally or unintentionally, make your account appear suspicious in the eyes of Meta's systems, and therefore get you banned, forever. 

That's what you want to avoid. That's why the WhatsApp Business Platform is the safest way to scale your business operations on WhatsApp. It has built-in mechanisms to prevent total and complete failure, whether in terms of quality or messaging reliability.

The formula

I’ve personally spoken to a few thousand customers over the years, and I’ve identified key elements that represent risk. I am a formula man. It works, most of the time, to quantify risk with numbers. At the very least, it gives you a framework to reason and think about risk. 

So, I introduce you to the WhatsApp 3rd Party Enabler Risk Score. Let's call it WEPERS (W3PERS) from now on.

Like any scoring framework, this can be subjective, but we aim to establish reasonable thresholds of risk. This is not just about vetting 3rd party enablers, but also WhatsApp's official offerings, and even alternative messaging channels that may actually work better for you.

Run this scoring exercise on a 3rd party enabler (specifically, ones that offer a browser extension), and let me know what scores you get.

Each category is scored from 1-10, where 1 is lowest risk and 10 is highest risk.

Technical reliability risk (TR)

How often does this solution break due to WhatsApp updates? How quickly can it be fixed? Can it be fixed at all? If it can't, will this feature just stop working forever?

The more resilient the solution is to WhatsApp changes, the more reliable your business operations will be. You want to avoid solutions that frequently break or take days, weeks, or sometimes never get fixed after WhatsApp updates. Some updates risk disrupting the entire method.

An example of a high risk option here would be a browser extension built on top of WhatsApp Web that scrapes web elements for messages to sync them to other platforms. One small change in the HTML, and the extension’s job is over.

Some of the risks are:

• Frequency of breakages due to WhatsApp updates

• Developer's track record of timely fixes

• Compatibility with different devices/browsers

Legal compliance risk (LC)

Does this solution comply with WhatsApp's Terms of Service? Does it risk account bans or legal action? Does it risk being shut down by DMCA notices and takedown processes?

The more compliant the solution is with WhatsApp's policies, the safer your business is. You want to stay away from solutions that operate in legal gray areas or violate WhatsApp's terms. Again, these can lead to account bans, legal troubles, and reputational damage that can be hard to recover from.

An example of an unsustainable option would be a browser extension like this that enables you to bulk WhatsApp your contacts. This goes directly against WhatsApp’s Terms of Service.

An example of a sustainable, legal, and safe option would be a browser extension built over the WhatsApp Business Platform to detect phone numbers on a certain web page, and allows you to send a template message to one or more contacts (assuming they’ve given their consent). Similar to the Aircall Dialer chrome extension, but one built over the WhatsApp Business Platform. 

Some of the risks are:

• Violation of WhatsApp's Terms of Service

• Risk of account bans or legal action

• Data handling and privacy concerns

Security vulnerability risk (SV)

How well does this solution protect sensitive business data and prevent unauthorized access? Does it sit between you and the customer? Do they have the right to sell your data, and your customer's? Do you trust the developer? Or is it a random browser extension built by an unknown developer?

The stronger the security measures, the better protected your business and customers will be. Avoid solutions that break encryption guarantees, have poor authentication, or are subject to known vulnerabilities.

Some of the risks are:

• Exposure of sensitive business data

• Potential for man-in-the-middle attacks

• Authentication and encryption breakage or tampering

Feature parity risk (FP)

Does this solution offer all, some, or limited features of the official WhatsApp Business API? How will it handle future updates? Will it ever support engagement and interactive features?

The closer the feature set is to the official API, the more future-proof your operations will be. Most 3rd party enablers will score low here. You don't want to find yourself unable to use new, innovative features that your competitors can access while you’re stuck with unofficial wrappers.

An example of a high risk option would be one of the many OSS available that offer a headless, reverse engineered WhatsApp Web as an API.

Some of the risks are:

• Missing official API features

• Limitations compared to official solutions

• Future feature compatibility

Business continuity risk (BC)

How easily can we migrate from this solution to the official API if needed? What's the impact on my business if this service suddenly stops?

The easier it is to migrate or have a backup plan, the more secure your business operations are. Avoid solutions that create high dependency or make it difficult to switch to official channels. You need to be prepared for the possibility that a third-party solution might become unavailable or unsuitable in the future.

Some of the risks are:

• Dependence on the unofficial solution

• Difficulty of migration to official solutions

• Impact of sudden service discontinuation

Scalability risk (SC)

Can this solution handle our current messaging volume, grow with our pace, and integrate seamlessly with our other systems (e.g. CRMs, etc)?

The more scalable and integrable the solution, the better it can scale with you. Stay away from solutions that struggle under high volumes or don't play well with other business systems. For example, I’ve noticed over the years that using the WhatsApp Business app to manage a high volume of conversations daily can lead to an account ban.

Some of the risks are:

• Performance under high message volumes

• Ability to handle growing business needs

• Integration with other business systems

Soup

A real life scenario I recently encountered with a business which, for fun, I ran WEPERS on.

For the sake of not naming names, I will call it Soup — a startup offering a browser extension for WhatsApp Web to enhance business communication for sales people. The extension offers features like automated responses, basic CRM integration like activity logging, broadcasts, and message scheduling. 

Soup scores poorly on technical reliability due to inherent inability to respond to WhatsApp Web’s frequent updates. It also violates WhatsApp's Terms of Service by allowing broadcasts, which is a form of bulk messaging, meaning high legal risk. Security vulnerability is above normal; after all, it is a man-in-the-middle with weak encryption, or no encryption in some cases. Feature parity is low, lacking official API capabilities and interactive messaging support. Business continuity is at risk due to high dependence and difficult migration. Scalability is limited, struggling with high volumes and growing team needs – lastly, once there is a higher than normal volume on some of the salespeople’s accounts, that can trigger Meta's systems to flag suspicious activity, increasing the risk of account bans.

• Technical Reliability Risk = 7

• Legal Compliance Risk = 8

• Security Vulnerability Risk = 9

• Feature Parity Risk = 6

• Business Continuity Risk = 7

• Scalability Risk = 8

(7 x 0.2) + (8 x 0.2) + (9 x 0.2) + (6 x 0.15) + (7 x 0.15) + (8 x 0.1) = 7.55

This gets us a WEPERS score of 7.55!

Soup easily falls into the "Critical Risk" category. This is an example of a solution that you should avoid at all costs. It may work for a few days, or a few weeks, but it will most surely disrupt your business, and likely without any warning. This example is at the riskier end of the spectrum. There are many more that won’t score this high, but that doesn’t mean they don’t carry enough risk to stay away from.

But let me play the devil's advocate here. Even if Soup had a near-perfect Security Vulnerability risk score of 1, their total WEPERS score would still be a concerning 6.15. This highlights an important point: while security is critical, it's not the only factor. Legal compliance, technical reliability, and other risks remain significant.

So, even with bulletproof security, 3rd party enablers like Soup still pose substantial risks to your business. 

When it comes to WhatsApp for business, official channels aren't just safer – they're often the only sensible choice.

Try out my WEPERS calculator here

Is it worth it?

As an observer, I think it is not in Meta's interest to see 3rd party enablers having a ball and eroding WhatsApp's trust.

But lately, I think Meta has been fighting back a little differently. They’re fighting back through delight. How? I’ve spoken about this in detail here. They are turning WhatsApp into a true platform, with capabilities that will make the benefits or conveniences of using a 3rd party enabler void and obsolete. 

Every WhatsApp capability out there that makes the WhatsApp Messenger or Business app special will most likely be API-fied in the future. It will be scalable, customizable, configurable, and reliable—like a system of lego bricks that can be shaped into great products built on top of WhatsApp, benefiting millions of businesses. Evidence? The recent updates at the Meta conversations event in June included powerful platform announcements like Voice (or Business Calling), and Groups as an API.

I predict that in the next few years, we will see most, if not all, 3rd party enablers—specifically browser extensions—vanish. Eventually, businesses will see the true gold standard of using WhatsApp to scale through the WhatsApp Business Platform.

What does good look like?

Not all 3rd party enablers are bad or malicious. Although I recommend against using the majority of the 3rd party enablers out there, I think there is a version of what good looks like. 

It’s a no-brainer that my first suggestion, for obvious reasons mentioned above, is to stick to the WhatsApp Business Platform. There are plenty of providers out there that do this well. It's their bread and butter.

Business use

Picking a provider built on top of the WhatsApp Business Platform is always a good start. But this doesn't mean you have to give up the convenience you found with 3rd party enablers. 

For example, I’ve seen providers that built browser extensions over the WhatsApp Business Platform to detect phone numbers on a certain web page, and allow you to send messages to one or more contacts. Similar to the Aircall Dialer chrome extension, but one built for the WhatsApp Business Platform. 

This type of browser extension acts as a helper or an assistant, rather than as an obscure layer that takes over and runs on top of your WhatsApp Web (which potentially breaks your end-to-end encryption, and other security guarantees).

You have clarity on what this browser extension does by inferring what is possible through the WhatsApp Business Platform. You also have several layers of protection against account bans, such as message template quality, phone number quality, account quality, and your Meta Business Account quality.

Moreover, you can be confident that this solution won’t suddenly break. It’s going to scale with you and your needs. It will allow you or your technical peers to extend and customize your WhatsApp interactions in endless shapes and forms. 

Low risk, reliable, scalable, secure, convenient, and with endless customisation possibilities.

Conclusion

Phew, we covered a lot today. Most of what I wrote here has been sitting and building up in my head over a couple of years. It feels good to put it all together in one place.

To sum it up, here are the key takeaways:

• WhatsApp is built on trust: it’s the backbone of meaningful communication, and abusing it, whether intentionally or unintentionally, erodes this foundational assumption.

• Abuse is inevitable, but preventable: understand the risks, steer clear of 3rd party enablers, and prioritize business reliability, customer delight, and pick what’s future proof.

• Official channels are the safest bet: the WhatsApp Business Platform is simply your safest bet for long-term reliability and sustainable operations.

• The future is official and feature-rich: Meta is likely to continue expanding official capabilities, and highly likely that the unofficial methods will become obsolete.

• Beware of short-term gains: quick fixes in the short term can lead to lasting damage in the future. Prioritize future-proofing your business.

This is the third article I’ve written about WhatsApp. I want to leave you with a personal note on why I write about this particular topic:

I’ve always found the idea of a message attractive and interesting. Any kind of message carries some form of intention. Whether we consciously choose or not, a message with an intention is a message with a motivation, and motivation is very human.

If I look back at the things that excited me the most in my career, it would be choices I made like working in my spare time on networking protocols (messaging between machines and people), or joining a business messaging company like Intercom, or building connections between messaging services (Slack + Intercom), or starting two companies in the business messaging space. How humans communicate with each other, and with other objects around them, and how this evolves is the most fascinating and exciting quest I can think of spending my time on. 

Communication is never stagnant. It keeps evolving. It keeps changing. Today it’s WhatsApp, tomorrow it may be brain-to-brain LLM fine-tuned neural thinking protocol. I want to be part of it all and can't wait to witness how we evolve.

A huge thanks to my close friend Mohamed Elbadwihi for his feedback, copy editing, and relentless encouragement to get this done.

I'm not affiliated with Meta or WhatsApp. The views and opinions expressed below are my own and do not reflect those of any company or organization.

There are 1,738 startups on Crunchbase with the word WhatsApp in their descriptions. Of those, 388 are funded. With Y Combinator invested in at least 10 startups that are built entirely on WhatsApp in the last 3 years. What's happening? What are all these startups doing?

In the next six short acts, I will help you make a well-informed bet on a startup you’re looking at or want to build. How? I will give you (1) a formula to vet them, (2) a tour of the WhatsApp landscape, and (3) red flags to watch for – and as a bonus, some predictions.

Act I: Earth? Hello? WhatsApp

You’re here because you’re hearing the word WhatsApp flying around more often than to be ignored – maybe more so in the last 3 years? Maybe you’re seeing big funding rounds from major VCs, or signs of WhatsApp turning into a super app. Maybe all of that, or maybe you’re just curious.

You’re not wrong. You can’t afford to ignore this anymore. I will explain why, but first, here’s something from Scott Galloway’s predictions for 2024 to get us warmed up:

The new swing votes that decide the world economy and world politics are the kingdom (Saudi) and India. India is going to add more consumers to the middle class than any nation in the world. Who does that benefit in big tech? WhatsApp. 95% of Nigerians, 77% of Indians, the number one and number three most populous nations in the world – their primary means of communication is owned by Meta. Also, you read every message on WhatsApp, you don't read every email, you don't even read every text. It's the least monetised platform in the world right now. Think of it as the most under-utilised real estate in the world.

What have we got here?

1. The least utilised real estate in the world is WhatsApp.

2. The most populous nations and the country with the most growing middle class in the world use WhatsApp (and will continue to use WhatsApp).

Two powerful statements, backed with facts, to tell us that WhatsApp is the tool humans rely on the most for their daily communications. It is where humans talk to each other today. It is where communication happens, for most of the world.

In 2021, WhatsApp generated $790 million in revenue, almost all from the WhatsApp Business App. In 2023, WhatsApp Business made an estimated $382 million - of which $155 million came only from Asia. Europe was the second highest - spending around $90 million on the messaging app.

Since early 2013, WhatsApp has gained 200 million active users & the daily message volume continued to climb. After it was acquired by Facebook in 2014, WhatsApp’s active user base saw an immense 365% increase - from 465 million to 2 billion monthly users.

If you still feel lost on the history, I got you – read on why I think WhatsApp is irreplaceable.

Act II: Why WhatsApp? 

By the numbers

If we search Crunchbase for companies with the word WhatsApp in their description, here are what the numbers look like –

• 1,738 startups (40% of them are software/SaaS)

• 388 funded startups

• 31 were acquired

• 21 made acquisitions

• Most of them are headquartered outside the US

These numbers by themselves don't make a thesis, but it must be making you curious.

In contrast, there are 61,000 companies in Crunchbase with the word Email in their description. It’s impressive to compare both, knowing that WhatsApp only released their WhatsApp Business Platform (API) just 5 years or so ago. That was when it became possible to build products over WhatsApp. To put things in perspective, the first email was sent 53 years ago – in 1971. This is a superficial comparison, but it tells us something. A new type of Email alternative is now possible as a business-to-customer communication channel and people are willing to build + bet on it. This is a rare event.

WhatsApp as a platform, by rocket analogy, just started its burn off stage. Companies are still trying to scramble and figure out – How do we utilize this channel? What do you mean WhatsApp has 98% open rate and email has a mere 20%? WhatsApp ate through most of the world – LATAM, India, MENA, Africa, SEA, and it is starting to aggressively eat into the EU (starting from the south, towards the north), and it will peak when it hits the US. It’s happening now, and with proof – read the excerpt below from Meta's Q1, 2024 earning's call by Zuckerberg.

WhatsApp lies so perfectly between a phone call that requires your attention right now, and an email that is async and by nature forgettable. You don't forget about WhatsApp because that's where your friends and family are, and most humans will respond to their friends and family. On their way to get back to their friends, they will see your message(s) from your business and will likely to engage with it.

We are yet to see the peak of the WhatsApp opportunity.

WhatsApp = Platform

Meta is all in on WhatsApp as a platform. But why should you care? Just as smartphones evolved from basic communication devices to platforms for countless apps and services (games, banking, navigation), WhatsApp is transforming from a messaging app to a platform. Endless possibilities unlocked for all companies out there trying to run their businesses over WhatsApp. Every use case that wasn't possible before due to the limitations of the WhatsApp Messenger or the WhatsApp Business App will be possible by building over the WhatsApp Platform.

Meta shipped a ton of features that scream "platform" like flows, payments, interactive buttons, lists, commerce APIs, and a Cloud APIs offering. They're also sunsetting the On-Premise API (an early version of the WhatsApp API), which basically says, "We're betting on the cloud, folks". In their most recent Conversations 2024 conference, they mentioned that they are releasing Voice APIs, Group APIs, and much more.

It is also not just about features, it's about building an ecosystem. Meta's opening up API access, making it easier for developers to jump in and build. They want to attract builders of all kinds – from scrappy startups to big enterprises. They're laying the groundwork for WhatsApp to be as big as, or even bigger than, platforms like Salesforce, Shopify, or Slack. The potential is massive, and it's all about creating tight workflows that businesses will find hard to resist. This is just the beginning – there's a whole lot more to this story, especially with AI in the mix both with their Business App for small businesses and their Cloud API offering.

To recap a few recent events:

• Opened up API access, making it easier for developers to build.

• Sold Kustomer after a year of acquiring it, to focus on WhatsApp's own platform development.

• Launched Cloud API offering, sunsetting the On-Premise API.

• Released building blocks for developers – Cloud API, Commerce API, Flows, Interactive Buttons, Lists and more.

• Zuckerberg emphasized platform focus in Q1 2024 earnings call.

We must be clear that WhatsApp has three distinct products. The WhatsApp Messenger made for people like you and me to talk to friends and family, the WhatsApp Business App for micro and small businesses – it is also an app like the WhatsApp Messenger with additional features, and most importantly, the WhatsApp Business Platform (API) which is our focus topic for today.

Act III: Early Monetisers

This is the story of how the first wave of companies made their money – by building over WhatsApp. The first release of the WhatsApp API was late 2018 and mid-2019. The release triggered the first WhatsApp gold rush (and I dare say, we're in the midst of the second). But this API wasn't your typical plug-and-play. You couldn’t just get an API key and start building. Hold on, what? You were required to setup a whole infrastructure first. It needed time, effort and a technical know-how. More importantly, you needed to be a very close partner to Meta.

Why was it that way? WhatsApp's magic happens mostly on your phone, with the server side acting as a glorified router. So Meta needed a way to take that client into the cloud and I think they didn’t want to carry the hardware deployment investment themselves – it is basically headless WhatsApp client in the cloud. They outsourced the hosting of this "headless" WhatsApp in the cloud to partners like established CPaaS companies (think Twilio), Telecom companies and a select group of startups.

Initially, access was tightly controlled through Business Solution Providers (BSPs), this created an influx of hundreds of thousands of businesses around the world approaching the BSPs. This was good business for CPaaS and Telco companies (who were BSPs of the WhatsApp Business API), charging per-message fees (later conversation fees) on top of Meta's cut. Meta finally got a taste of WhatsApp revenue, but at a cost.

This model, while lucrative for CPaaS and Telco players, might have stifled Meta's own potential. Or at least I think so. Proof? They're now sunsetting the on-premise API in favor of their own Cloud API offering. Now, the markup-driven CPaaS model has reached its limits. The real value lies in building useful applications on top of WhatsApp.

In hindsight, I think if Meta had invested a few more months upfront in building their Cloud APIs, they might have accelerated their ecosystem growth, attracted more builders, and made more money. Let's be real, Meta knows how to build APIs, so this was likely a strategic decision.

The good news? API access is less gate-kept now, opening up opportunities for a wider range of innovators. This brings us to the second wave of monetisers explaining the landscape.

Act IV: The Landscape

Now that I managed to convince you to write your first cheque for a startup building on WhatsApp (did I? If not, let's have a coffee), where do you actually go from here? What are the pillars of your investment thesis? Don't worry, I got you – I’ve done the homework through building two startups over WhatsApp. One bootstrapped and one VC funded. I also spoke to thousands of businesses over the last 6 years using WhatsApp. Get a sip of coffee, roll-up your sleeves and let's dig.

WhatsApp, as a communication channel, cuts across every vertical, industry, use case, platform, customer size, you name it. It is a big landscape and it is changing – very fast. WhatsApp is bettering their platform, launching new capabilities on their WhatsApp Business Platform (API) every month, and new use cases are opened consequently.

Take every SaaS that exists today, and replace the SMS, Email, Livechat, and Phone dependencies with WhatsApp – this is your landscape. There will be a clear Mailchimp for WhatsApp winner, a Shopify over WhatsApp, a Zendesk over WhatsApp and I dare to say even a Slack over WhatsApp. In fact, there are many of those seeds existing today.

Here are the biggest fundraises for companies built entirely on top of WhatsApp – 

• WATI raised $23m

• Charles raised $20m

• Treble.ai raised $15m

• Felix Pago raised $15.5m

• Tuvis raised $11m

• Landbot raised $8m

• Luzia raised $10m

and many more smaller rounds!

Use cases

There are three dominant use cases – sales, support, and marketing. These are also umbrella covers and overlap with verticals, platforms and other types of businesses. After all, all businesses support, sell and market their products.

Marketing

This is perhaps the most important bet companies are making on the WhatsApp platform now. It is a risky bet, but oh well, with high risk comes high reward.

Why marketing? Simple, email marketing SUCKS, most email goes into spam, and the ones that come through have an open rate of a mere 20%. In some regions like LATAM or MENA, trust me – no one opens their damn email anymore over there. WhatsApp's open rate is 98%. Email is not going to die today, or maybe ever, but it is clear that certain parts of the customer journey are not valid for Email anymore.

So where does WhatsApp marketing fit? Big brands, specifically consumer ones, care about ROI. More and more budgets allocated to trying things out and experimenting. They ask what can we do to generate more sales? Brands want higher engagement rate to drive the consumer down through purchase funnel. There is no better channel than WhatsApp. High open rates, high every-other-metric down the funnel. The formula is simple: brands invest in starting conversations over WhatsApp, where open rates are exceptionally high, and ROI per conversation is high. Meta's interest lies in regulating content & delivery quality of the platform to keep the open rates as high as they are today.

So why do I assume high risk? Two things – margins, and regulations. Meta fees are paid to Meta directly by the business, or sometimes billed by the product company then some is paid to Meta. If the product is dedicated entirely to WhatsApp marketing, I'd definitely dig into their margins after Meta gets its cut. Another risk is regulations and Meta's direction – If I am in Meta's shoes, I'd fight hard to keep WhatsApp's pristine 98% open rate as is – and they are. This means Meta can change the rules and it can affect the trajectory and growth dynamics of a product company betting solely on the marketing use case for WhatsApp. There is an example of this when WhatsApp recently introduced per-user marketing messages limit.

Support

This tends to fall into two categories: (1) existing incumbents and (2) shiny new things. 

Incumbents

Incumbents like Zendesk, Intercom, Front, and others understood fairly quickly that they need to go omnichannel – a business in Brazil will simply be out of business if they don’t support their customers over WhatsApp. What does Zendesk, Intercom and others do? Go omnichannel. Support WhatsApp, Messenger, Instagram, SMS, Phone, and so on.

Shiny new startups take the AI route – because it is incredibly hard for new startups to compete and win in the support use case against incumbents if you compete feature-vs-feature (I may be proven wrong with the likes of Superchat, Sleekflow, etc .. let's see!)

Startups

The second category only happened because of LLMs and AI progress in the last year. They are AI-first, built for WhatsApp, and trying to avoid playing the catch-up game with the incumbents. The thing is to build a customer support platform today to disrupt and/or meaningfully compete with incumbents: (1) you need to find a way to have a clear edge over incumbents (e.g. do what Linear did but for support, folks like Plain), (2) you need to be omnichannel from the get-go, and (3) you need to be an AI-first company. Winning in support now is tough but also ripe for disruption. We will see incumbents die, and some reborn in support.

Sales

I think this can be the toughest to crack but probably the biggest opportunity for startups to build on WhatsApp. Also, I am biased, because I am betting on this. 😉

This is more generic, wider in scope and ambiguous than the above two use cases. Every business sells. What kind of selling are we talking about here? 

Two types of selling →

• High volume, low price transactions

eCommerce is a visible vertical here, and Meta is betting big on this. Meta's released features over the last few years shows clear evidence that they want to make a dent here.

Usually, software companies building under this category have two modes:

(1) I want to offer an end-to-end eCom experience on WhatsApp including product discovery, cart management, payments, and notifications, – they do this either using Meta's commerce tools or they go fully betting on LLMs/AI.

(2) I want to offer part of the eCom experience on WhatsApp – part of the journey, maybe just the discovery, or just the payment, or the notification (cart recovery, delivery updates, etc), or the support for commonly asked questions.

You will find the likes of Hello Charles, Zoko, Interakt, and other much bigger companies working this category religiously.

• Low volume, high price transactions

This is where you’re selling a home, or an expensive car, or even a B2B Software – if you're selling in this category, you need to build a relationship with the customer. Part of this can and will be automated, but doing this over WhatsApp is not figured out yet.

Think of a sales team with tens of SDRs and AEs in a SaaS company – their buyers don't use Email, they use WhatsApp. You're a sales rep, juggling multiple conversations with potential customers. You're switching between your CRM and personal WhatsApp app, trying to keep track of all the interactions. It's chaotic, it's stressful, and it's inefficient. Now, imagine a different scenario: all your WhatsApp chats with customers are managed from one place – synced with your CRM (HubSpot, Salesforce, Pipedrive, Zoho, etc). No more inefficiency, no more lost messages, no more chaos.

CRMs, sales engagement or conversational sales products, and the rest in this category will need to adapt. Because conversational buying, whether it is B2C or B2B is the future. A B2B buyer looking for a tool to help their sales team be more efficient, is the same exact human who starts their buying journey on their couch at night by scrolling through their instagram or Facebook – click, click, bought. B2B buying is changing and the change is in the conversational nature. Sales products need to adapt and use the best of the modern messaging apps.

Verticals

The main reason a startup would select a vertical and build around it on top of WhatsApp is that WhatsApp usually cuts across business functions (sales, support, activation, retention, etc). In messaging-first markets where WhatsApp is fundamental, usually a business sells over WhatsApp, then very soon after a transaction/deal is closed, the customer wants to stick around for support or to talk to the business for other reasons – support, activation, etc. This happens over WhatsApp too. Once started, a conversation over WhatsApp stays there, likely for the entire length of the customer's lifetime. So by default WhatsApp cuts through entire business functions within a company. 

Take JemHR for example. They built their HR software to function natively over WhatsApp. Their product definitely has an interface, but the notifications, communications, documents, surveys and other features are the employee’s interface. It is that severe of a problem that the employees check their WhatsApp much more often than their Email.

The business that buys this software finds the utility extremely valuable because traditional HR software built over Email, or SMS, or whatever other channel don’t work for them anymore – specifically because those businesses are located in a high WhatsApp penetration geo like South Africa.

There are many examples of JemHR in other verticals, and there will be many more in the coming months and years.

Platforms & enablers

CPaaS

Big elephant in the room: CPaaS companies. How do CPaaS companies stay relevant when they can’t really justify markup over meta conversation fees? Realistically, you can acquire a free WhatsApp Cloud API account and pay Meta their fees directly. 

The answer is that it depends on the CPaaS company. Some can build good products, most don’t. Messagebird (Bird) had to re-invent a few times – they rebuilt their application-layer (inbox, etc) a few times to stay relevant. Others don’t seem to yet get the memo, or only consider WhatsApp as a complimentary channel to their much more core offerings (e.g. Twilio).

Integration-only

Other companies use WhatsApp in a different way. Their use case intersects with WhatsApp in a shallow way more or less, either that or they took the strategic decision to build or integrate just enough with WhatsApp to tick it off their list on sales calls. A good example of this would be CRMs – they tend to build a superficial integration layer with a communication channel like WhatsApp, and they strip off what makes WhatsApp actually special; its interactivity. While it alleviates some of the pain, it doesn't remove it. WhatsApp is a communication channel that's rich, interactive, realtime – the consumer bar is high for how they use WhatsApp, even when they start talking to businesses. A thin integration layer is sometimes worse than no integration at all.

While writing this part, I realised that I can write half a book on the landscape, and so I stopped myself before it is too late. I don't wish for that sip of coffee you took earlier to be a barrel. But I know you want to know more, so I promise that I will cover the rest (screenshot below) of the landscape in other articles. If you want to get an early draft, subscribe. 😉

Subscribe now

Now to the more exciting part – how do you hunt?

Act V: How to hunt?

If you’ve reached this far, congratulations! This is where I have some half-decent advice to provide.

I thought about this for a while – a few years actually. The biggest concern for any VC betting on a startup built on top of a platform would be the platform risk, and rightly so. It is not a WhatsApp-specific risk or problem, it is a general platform risk. This is the same for a startup building on top of Salesforce, or Shopify, or Slack, or OpenAI, or even Apple. Unlike Email or other communication channels, WhatsApp is not an open platform or protocol. It is owned, managed and regulated by Meta. They have the final say. This can sound scary to an investor.

So I asked myself, is there a way I can quantify the risk of a platform? Specifically Meta/WhatsApp as a platform? Maybe there isn't a sure fire way, but there is something that can get us close enough.

I am not looking into elements like market size, product, traction, exit potential, PMF or your gut feeling about the founders – those are really dependent on the company and are foundational before we even quantify the risk of building over the platform. I leave these for you.

The formula

I came up with a few dimensions by watching Meta's manoeuvres and strategy closely over the last 6 years. I give each of the below dimensions a weight based on my answer's confidence.

• Reliance on WhatsApp Business API

Is the startup using the official WhatsApp Business API (good) or a less reliable, potentially non-compliant workaround?

The more the company you invest in relies on the official WhatsApp Business Platform, the more solid this business' foundations will be.

You want to avoid startups building on top of any kind of reverse engineered WhatsApp Web API – solutions like this are a recipe for disaster. Not only is it hard to keep up with WhatsApp Web versions and it just stops working one day, but it also gets accounts banned, and sometimes forever. It goes against WhatsApp’s terms of service. More over, Meta is pushing more of its capabilities to their Cloud API.

• Meta Fee Impact

How much of the startup's revenue will be eaten up by fees charged by Meta for using the WhatsApp Business API?

How much money does the startup make after Meta gets its cut? E.g. a plethora of startups building an abandoned cart notification over WhatsApp for Shopify; they can be profitable under certain conditions, but most are not sustainable or VC-fundable because of Meta fees and margins.

• Meta Competition Risk

How likely is it that Meta will develop a similar product or feature, directly competing with the startup?

What is Meta unlikely ever going to build? E.g. Meta will likely never build a dentist software with 1-1 communications and consultations done over WhatsApp.

Any platform will give the builders a system of lego blocks. They do that because they want the builders to solve problems using the lego blocks, which will serve the greater good of their platform's users. The problems you’re solving should not go against or be in competition with the system of blocks, or the blocks themselves.

• Meta Roadmap Alignment 

Does the startup's product vision align with Meta's roadmap for WhatsApp?

Meta will keep releasing platform features and adding more capabilities. Do what they release match the problems you are trying to solve? Are you building with their lego blocks? Or are you building with virtual lego blocks that aren't yet a reality and possibly likely will not be?

• Integration vs. Problem-Solving

Is the startup merely integrating with WhatsApp or solving a significant problem unique to the platform and the platform's audience? Or is it a thin layer on top of yet another platform?

I built my first bootstrapped startup and got it towards a million dollar in ARR entirely by building a thin integration layer to connect WhatsApp to Intercom. A couple of years later, Intercom built their own version, and the rest is history. You want to avoid this kind of situation. It may make for a good lifestyle business, but pose a big risk to a VC-fundable one.

• WhatsApp Penetration in Target Market

What percentage of the target market actively uses WhatsApp?

WhatsApp ate most of the world's person-to-person communication. You want to invest in startups in regions where WhatsApp is interwoven into the fabric of the society – inseparable. WhatsApp has not yet peaked in the US but it will in time. As of today, it'd be a bad bet funding a startup built entirely over WhatsApp and trying to find customers in the US. The WhatsApp penetration and business-to-consumer WhatsApp communication opportunities in the US are not comparable to LATAM, or India, or big economies like Indonesia or the MENA region.

• Meta Business Partner Status

What level of partnership does the startup have with Meta (Meta Business Partner & Meta Tech Partner, Meta Tech Partner, Meta Tech Provider, or using the free Cloud API)? Higher levels indicate greater access to resources and support, but also potential dependence on Meta.

A final but not scored dimension is the Meta Acquisition Friendliness – basically, to what extent does the startup's product or technology align with Meta's strategic interests, making it a potential acquisition target? Higher score in acquisition friendliness here is not a good thing. It is not a bad thing per se to be acquired by Meta, but it is just not an outcome liked or preferred for a VC investable business.

–

The final formula includes the dimensions we mentioned with almost equal weights except for 3 dimensions. The minimum possible score is -0.1 and the maximum is 3.0.

Let's take an example, an imaginary startup called CommerceUp. A company targeting e-commerce brands to help them sell more effectively using WhatsApp as a high engagement channel. Assume they are a Meta Business & Tech Partner. Their product works with Shopify, WooCommerce, and BigCommerce. We assume high reliance on WhatsApp because it is built on top the WhatsApp Business API (this is a good thing – they are not using a reverse engineered API), strong alignment with Meta’s roadmap being in the eCommerce vertical, and high penetration in the target market (they are targeting LATAM) outweighing the moderate negative impacts of fees. It is not a thin layer integration, it is a complete platform connecting the eCommerce platform stores with a 360 degrees buyer journey coverage over WhatsApp.

From a Meta's thesis point of view, a score of 2.8 (out of a possible maximum of 3) is what we got – I consider it a strong investment opportunity – assuming other foundational metrics an investor looking at are solid.

I scored 30 companies built on WhatsApp or using WhatsApp today as part of their product – if you want the excel sheet with the scores, be one of the first 10 subscribers (when I publish this) and I will send it your way 😉

Subscribe now

Red flags

3rd party WhatsApp APIs

This is my number 1 red flag. Businesses should be built on solid foundations, specifically technology businesses. Brittle technology foundations kill businesses. There are a plethora of reverse engineered WhatsApp API options with paid services built on it out there. They do make and will make a lot of money, but it’s only temporary. This is a dangerous bet and an unsustainable risk. Not only that everytime WhatsApp changes something in their protocol or web clients, you face a big operational and reputation risk, but you’re also going against WhatsApp’s terms of service. 

Taken from WhatsApp's terms of service:

(a) reverse engineer, alter, modify, create derivative works from, decompile, or extract code from our Services; 

There are examples of other startups like Cooby or Tuvis that do this in a bit of a different way – as a chrome extension built on top of the existing WhatsApp Web (or desktop) interface. Hard to predict, but what if we see a future where WhatsApp focuses on native apps and deprecates the web version?

Meta's territory overlap

Meta made it clear it wants to help micro and small businesses with their WhatsApp Business App offering and all the tooling they provide around it. It is risky to offer the same or close offerings as Meta is to small businesses. The strategy is to help micro and small businesses succeed, so they grow out of those offerings and use the WhatsApp Business Platform (API) which is paid. 

Ask yourself, what is Meta unlikely ever going to build? How likely is Meta going to build a dentist software with 1-1 communications and consultations done over WhatsApp? If the answer is extremely unlikely, then pursue.

Thin integration layer

This one is my favorite, because I built one doing exactly just that. I made some good money, took it all the way to almost a $1m in ARR. But this business was either an eventual small acquisition or a closure. It is simply not a VC investable business. 

What is an example of such business? Octopods is one example. Intercom, at the time, was great for Live Chat and Email communication, but many of their customers wanted to use Intercom for WhatsApp (and other channels). So I went on and build Octopods entirely over Intercom – WhatsApp as a thin layer integration and it worked beautifully. But my entire business was one step away from Intercom’s product folks waking up one day and deciding to work on the same kind of integration and it happened when it made sense to them strategically. Luckily, this was a bootstrapped business and it was still worth it to start.

Lesson learnt – if I want a side business, then sure. A VC investable business dynamics is entirely unfit for this category.

Meta fees

Not to repeat myself, this is simple – make sure that the startup you invest in have good margins over Meta fees. Adding a markup over Meta Conversation fees isn’t a terrible idea, it can be very profitable when done right. But it is important to understand whether that markup is (1) high above Meta fees, (2) aligns with the startup’s customer incentives and shows clear ROI for them. 

Act VI: Predictions

I think WhatsApp can be used in so many different contexts and ways – both in the B2B and B2C worlds. If Meta played this right, exposed the right building blocks for developers, regulated and policed it reasonably, stayed out of the way – builders will innovate and 100x its value + impact in the long run.

AI

LLMs, LVMs, LLAMs working together will change customers communicate with businesses. Sales, support, success, retention, and more will be changed forever by AI. We are seeing what this looks like for support. Expect this to massively increase WhatsApp's potency in the coming months and years. The more capabilities Meta released to their Cloud API, the more possibilities.

New capabilities are likely to affect the way Meta charges WhatsApp fees now – maybe it won't be per conversation anymore, maybe it will be through unit of work done, or through a markup over payment transactions happening over WhatsApp. Who knows, maybe Meta's Llama will also be part of this future.

Capabilities

If you want to know what's possible with the WhatsApp Messenger (the friends & family app), look into what Telegram does today. A fantastic app and platform. The WhatsApp Messenger is full of capabilities but has a bit of catching up to do to where messengers like Telegram.

Meta managed to bring much of the core features of the WhatsApp Messenger to the WhatsApp Business Platform (API). But the really powerful capabilities are still not opened up yet.

Channels, Communities, Groups, Voice & Video calls and many more – if those features are API'ified, it'd unlock an immense amount of value, possibilities and use cases for builders betting on the WhatsApp platform.

If WhatsApp provided some sort of WebSocket-based API for Video Calling tomorrow, I dare to say Zoom's stock ticker will take a dip. Builders will build a Zoom-equivalent over WhatsApp the day after the API's release.

Payments

This is not a prediction per se, because it is already happening. Keeping in mind WhatsApp's penetration in different geos around the world – WhatsApp can be potentially a bank-as-a-chat provider. There are endless possibilities here that I don't even know where to start, so I will leave it for your wild imagination.

Super App

Imagine a world where WhatsApp has tiny apps within the chat and I am not talking about WhatsApp Flows – tiny fully-fledged apps that installable, interactive, and can be part of a person-to-person chat, not just a business-to-person. You can search those apps, they can be triggered by just typing a message, a gateway to the world of apps outside. In this world, apps become irrelevant, WhatsApp is the OS. Unsure how that would sit with Apple though.

Community

WhatsApp already has a Community feature. If this is opened up as an API – builders will open up a world for better management, analytics, sentiment analysis, polls, paid subscriptions, and more to let community managers get the best out of WhatsApp communities. Meta themselves may offer these tools directly.

Business-to-employee (B2E)

In messaging-first geographies around the world today, employees would use WhatsApp over any other business communication tool. They'd make groups, and manage work there. I have heard this over many calls with companies – They don't find a better way than WhatsApp to reach or respond to their employees. Think an IT department receiving some ticket, they do that over WhatsApp. Collaboration inside of the workplace is an interesting category and I wonder how companies will cope with that over WhatsApp.

Marketplace

Briefly touched in the Super App prediction – imagine a marketplace of apps used to offer certain services with a chat-like interface to take certain actions. Order an Uber or a pizza, do your grocery – look for businesses close to your current location, and talk to them. Part of Uber's fourth quarter reporting for 2021 experimenting with WhatsApp:

Conclusion

We have gone through the story, a 360 view of the WhatsApp landscape, the formula to find your winning startup, and the red flags to avoid.

A few key takeaways –

• WhatsApp is the new frontier: It's where the world communicates now!

• Platform risk is real, but manageable: Use my formula to assess a startup's risk factor building on Meta, their ability to navigate the rules, and their potential reward.

• Focus on solutions, not integrations: Look for companies solving real problems specific and aligned with WhatsApp's strengths.

• Pay attention to Meta: Their moves and roadmap matter. Aligning with their vision can be a major advantage.

• Watch out for red flags: Avoid risky bets on third-party APIs, businesses encroaching on Meta's territory, or thin integration layers.

• Sales over WhatsApp: conversational buying, whether it is B2C or B2B is the future.

Phew, this was long. Even for me, the writer, to go through. You must be exhausted. Hope it was a tiny bit useful. If it is, then good news – I will write more, because there is much more to tell. If it wasn't, I am sorry. 🌹

A huge thanks to my close friend Mohamed Elbadwihi for his feedback, copy editing, and relentless encouragement to get this done.

I think one of the very few consumer technologies that is probably irreplaceable nowadays is WhatsApp. WhatsApp is so ingrained in how some societies communicate that it triumphs over phone calls, sms, and any other form of digital communication. Its rise explains this a lot. The app found a few great attributes to perfectly position itself and have the rare network effects it needs to grow, and oh, boy, did it grow.

Act 1 – the beginning

A few things happened at the same time in developing countries that just shot WhatsApp to the top – smartphone availability increased, the blackberry dominance, the iphone was a couple of years in, SMS was expensive, data packages were introduced to the masses. WhatsApp came in paired with your phone number, free, simple to use, and it was released just two years after the first iphone. Developing countries were the last piece in the puzzle.

The WhatsApp team doubled down on the blackberry with a version, Symbian version, then an Android right after. They even had a Windows Phone version (remember windows phone, what a shit show that was). It was a perfect moment right after the blackberry release for them to have the right set of network effects working together. In less than 4 years, it grew to 200 million active users. 

Today WhatsApp is the go-to communication method to many regions of the world with complete dominance. It is not just an app. It is the communication medium. My mom, back in Egypt, uses WhatsApp to get some orders from the grocery shop down the road, or do a takeaway order or order a medicine from a nearby pharmacy. You can’t tell my mom to use Telegram instead. She won’t. This is the new mom test but for people's preferred communication medium. If your mom doesn't know how to use any other messaging app or platform except the one, you know that app made it.

Act 2 – it is just business

So naturally Zuckerberg swooped in and bought it in 2014 for a staggering US$19 Billion and it only had 55 employees. He very well knew what he was doing. He didn’t just buy the users. He bought the irreplaceability factor. He knew very well that while there is still a ton of work to be done to reap the rewards, the harder work has been already done in the sowing. Most importantly, the sowing work is not copyable, or else he would have.

It took 4 years to start unleashing the actual plan. In 2018, Zuckerberg went in with the WhatsApp Business offering. This changed things, and we will have a day when we say, forever. Small businesses first – he has a plan, he starts from the bottom, all the way to the top. 

The premise is simple. Everyone is talking to everyone over WhatsApp in a certain region. When the penetration is so high for a communication method, it slowly extends to small businesses communicating with customers because small businesses are made up of, well, people too. But it's less of them so the switch is natural and is almost unnoticeable. Think about it, I run a small grocery store, I have 1 person working with me. My neighbor has my WhatsApp number, he sends me a message asking if I can send him over a few grocery items or even prepare it for him to collect after he is back. I, as the grocery owner, won’t be infuriated that his neighbor wants business. On the contrary, I will welcome that and attribute that to how easy it is to do business over WhatsApp. Then more and more small businesses talk to customers over Whatsapp, so this becomes an expectation when the next customer talks to another business, this time a bigger business, and so it goes. It is a beautiful adoption cycle.

This is precisely what happened. Bigger businesses started opening up more to using WhatsApp to talk to customers. Not just the slightly-bigger-than-small-business businesses, NOPE! You got all kinds of big businesses. Think big ecommerce websites, big B2C stores, big pharmacy chains, big travel agencies, and many many more.

Act 3 – problems = opportunities

When matters involve serious money, opportunities appear. So here is what happened – and I am a bear witness to this. In late 2018, big businesses in regions of the world like India, Brazil, Indonesia, Mexico, Russia, Philippines and a few other countries now talk day-to-day over WhatsApp to their customers. This became the norm. It is an everyday thing for businesses, and things were looking very good. Transactions are happening faster, customers are happy, businesses are happier, WhatsApp is growing and establishing its dominance even more and to quote Michael Scott, “With win win win, we all win!”. 

Problems started to come up though with conversation volumes ramping up. Because things got done faster, scale was possible, and the transaction volumes increased. The more volume a business has, the more problems start to appear. Businesses were using WhatsApp in the most rudimentary way. The WhatsApp Messenger at the time could only be installed on one device, even the WhatsApp Business app. You can connect a few more through WhatsApp Web. It was 2, then it was upgraded to 5 devices at a time. There were major connectivity issues, and you can only imagine how limiting, disorganized, and unscalable. Chats were dropping, managers didn’t know which person on the team were assigned to which chat, you couldn’t access the whatsapp chats unless you pass the phone, literally, to your colleague right beside you in the next chair – and worse, you can’t tell customers that WhatsApp isn’t scaling for you anymore and they are now angry.

Luckily, with every problem in tech, there is an opportunity. Problem solvers, and hackers swoop in. The problem was simple. Find us a way to scale our operations over WhatsApp, or we lose our business. Was it that drastic? YES! Remember what we said about expectations? People now expect to talk to businesses over WhatsApp. There is no going back.

Hackers managed to come up with several ingenuine solutions to the problem. I witnessed 3rd party providers running hundreds of, if not thousands, headless android emulators with the whatsapp app installed, or reverse engineered versions of the whatsapp web protocol – heck, we even did some work on reverse engineering the whatsapp web protocol when it was allowed to help our users connect whatsapp to Intercom.

This scaled well at first. Then the connectivity issues started to occur, the volume was just, even with the best engineered solutions, too much for WhatsApp. Facebook, at the time, started to crack down on all 3rd party or reverse engineered versions. Facebook even updated their WhatsApp policy to anti the widespread usage of all the reverse engineered versions.

This was obviously not going to scale. Something else was needed. Something reliable, scalable, and democratized. Fortunately, WhatsApp has been brewing something up! It was time to act on scalable solutions, and think about money.

Act 4 – the answer!

Around the end of 2018, and mid-2019, WhatsApp finally released an API. The WhatsApp Business API was born. Finally a solution that works. This was the moment where Facebook finally had their first shot at reaping the rewards. Monetisation of the WhatsApp world started. 

The WhatsApp Business API was gate kept at first with what was called, now in the relics of time, the Business Solution Providers. WhatsApp went for old school telecom providers and newish CPaaS platforms plus they were opportunistic with a few startups in certain regions. This is probably the strangest API play I have seen in my career. Due to the nature of how the WhatsApp app works, there is actually no server storage of messages – your WhatsApp messages (even in the older versions) were never stored on the servers, only the metadata. The phone was the server, kind of. So WhatsApp worked with the Solution Providers offering an on-premise, invite-only API where the solution providers will be resellers.

I remember Twilio was probably one of the very first few companies that got access to the WhatsApp Business API.

It took weeks to register a business on the WhatsApp Business API and the whole process was hell on earth. But things changed pretty soon. Facebook learnt that the Business Solution Provider model just doesn't work, doesn't scale, and is a bottleneck to achieving the big numbers.

WhatsApp steered away completely from the Ads business model, and focused on charging for messaging fees, at first, then conversation fees later on after a few lessons learnt. 

If a customer starts a conversation with a business, or a business starts a conversation with a customer over WhatsApp, a charge is incurred by the business depending on who starts the conversation. Users still use the WhatsApp app for free.

The next wave of businesses built over WhatsApp in just 4 or so years after the API availability was … just … insane. All kinds of businesses, in all kinds of verticals, in all kinds of use cases have unlocked their WhatsApp powers in some way. Existing companies started to support WhatsApp, incumbents like Zendesk acquired smaller companies and new companies were built around WhatsApp. I was in the midst of this, twice.

Businesses also noticed something different and powerful. Customers actually open their WhatsApp messages. A staggering open rate of 90% – compare this with Email which is between 17% to 28%. Yet another strong use case around WhatsApp-based Marketing opened up, and that began the focus of WhatsApp to charge more and up their revenue.

Act 5 – the SUPER man app

So what’s a super app? read here. Basically, it is one app to rule the daily digital activities and transactions of a consumer. You got communication, shopping, payments, transportation, accommodation and so on. Every app nowadays wants to be a super app – and that ain’t going to happen. The reason it isn’t is that to be a super app, you need to have control and dominance over the user’s attention or time daily in at least one category before you offer more. You can’t be the 3rd or 4th most popular messaging app in a certain geo and expect that you can just add one more use case bundled within your app and make it – that’s not going to cut it.

WhatsApp got that dominance over the user's attention or time attribute with their messaging as the core. They earned the right to take the very next step and sell you homemade strawberry jam supplied by Pam's Jams (Pam's Jam isn't a real brand – it is a "fig"ment of my imagination). They can connect you to small businesses around you, they can enable payments for 3rd party builders to innovate, they can collect data using a mini-apps framework inside of the app. The possibilities are endless.

If you want to know Meta’s focus and direction for WhatsApp, take a look at the events in 2022 and 2023. Meta sold back Kustomer after just a year of acquiring it. The WhatsApp team shipped the basic building blocks that’d make it a platform to allow builders to build on top of it and double down on the dominance. They shipped plenty of platform-focused features. Interactive buttons, and lists, better WhatsApp Business APIs, the Cloud API offering, a plan to sunset the On-Premise API, all kinds of interactive message templates, catalogs, carousels, payments in Singapore and India, and alot more. This is a clear message that Meta’s focus for WhatsApp is to build a platform that will attract and incentivize builders to build, big businesses to build relationships, and tight workflows. Workflows are the hardest to uproot. Ask any enterprise SaaS.

WhatsApp’s platform has the potential to be as big as or bigger than any of the big platforms out there – Salesforce, Shopify, Slack, you name it. There is much more to say here, more on the overlap with AI. But that’s for later time and another story.