A customer downloads a restaurant’s loyalty app, enters their number and waits for the code. Ninety seconds pass and nothing arrives. They check spam, check that the number was typed correctly, try again and by the third attempt they’ve closed the app and forgotten why they opened it. Nobody made a mistake. The OTP was sent, it just arrived from a generic, unbranded sender that looked enough like spam that a filter or the customer’s own instinct, quietly buried it.
That failure point, the first thirty seconds of a customer relationship, is where a lot of loyalty programs lose people before they’ve technically lost anything. And it’s happening on a channel that, done right, should be the most reliable one available.
WhatsApp has quietly become the highest-trust messaging surface most brands have access to. People check it constantly, they treat it as a personal channel rather than a marketing one and a message that arrives there gets read in a way an SMS or an email rarely does. But that trust isn’t automatic. It depends entirely on who the message appears to come from, and for most merchants today, the honest answer is: not them.
WhatsApp messages get opened at rates north of 90%, often cited around 98%. Push notifications land somewhere in the 20%-40% range. Email trails both, averaging around 20%. For a loyalty program, that gap is the difference between a message a customer actually sees and one that quietly dies in a notification tray or a promotions tab.
What gets lost when the channel isn’t really yours
Here is something that doesn’t get discussed enough. Most merchants sending WhatsApp messages for authentication or loyalty updates are doing so through shared, platform-managed infrastructure. The messages go out, the OTPs arrive and on the surface everything works. But the sending identity, the account the message technically comes from, isn’t the merchant’s own. It’s a shared resource, provisioned and managed on the platform’s side and that has real consequences that are easy to miss until they cause a problem.
A shared sending identity means the merchant has no direct relationship with Meta’s business verification, no control over how their name and badge appear to the customer and no visibility into template approval or delivery performance beyond whatever the platform surfaces to them. It also means that if a platform-wide sender runs into rate limits, template rejections, or delivery issues affecting other merchants on the same shared account, that risk is shared too, whether or not it should be. None of this is a rare edge case. It is a known limitation of authentication infrastructure built for shared convenience rather than merchant-level ownership, and most brands never notice it until a customer mentions the OTP looked “off” or a signup conversion rate quietly underperforms without an obvious cause.
What owning the channel actually looks like in practice
The difference between a message sent through a shared account and one sent through a merchant’s own verified WhatsApp Business Account is larger than it appears from the customer’s side. A generic sender might still deliver the code. A verified, merchant-owned account delivers it with the brand’s actual name and in many cases the green checkmark Meta assigns to verified businesses, both of which are trust signals customers have learned to recognize before they’ve read a single word of the message.
This tracks with what Como has seen across its own merchant base: business verification and a consistent, recognizable sending identity are directly tied to how willing customers are to open and act on a message. A code that arrives from a name the customer already knows gets treated differently than one that arrives from an unfamiliar number, even when the content is identical.
The same logic extends past authentication. A merchant who owns their WhatsApp sending identity controls their own template approvals with Meta, has direct visibility into delivery performance and isn’t exposed to issues on infrastructure shared with other brands. For a loyalty program, where the OTP is often the very first touchpoint a new member has with the brand, that ownership isn’t a technical nicety. It’s the difference between a signup flow that converts and one that quietly loses people at the first step.
What we built and why it matters
Como has introduced merchant-facing WhatsApp configuration inside the Hub, currently in beta, that allows businesses to connect and use their own WhatsApp Business Account for authentication messaging.
The first phase focused on connectivity: merchants can now configure their own WABA credentials directly within the Hub rather than relying solely on Como-managed sending infrastructure. The second phase extended the backend routing engine to fully support merchant-provided Meta credentials, with live account validation to confirm the connected WABA is properly set up, real-time retrieval of approved OTP authentication templates directly from Meta and secure credential encryption throughout. Existing Como-managed WhatsApp delivery continues to operate exactly as it did before, so merchants who aren’t ready to bring their own account aren’t affected by the change.
The result is that a merchant who connects their own WABA sends authentication messages under their own verified identity, with their own template approvals and their own delivery visibility, while everything else in the loyalty program continues to run on the same infrastructure as before. Nothing about the customer’s signup experience needs to feel unfamiliar. It just needs to feel like it’s actually coming from the brand they signed up for.
Trust travels through the channel, not just the message
The brands getting the most out of WhatsApp are the ones whose messages feel like they’re actually coming from somewhere real. A verified sending identity is a small technical detail from the platform’s side and a significant trust signal from the customer’s and the gap between those two perspectives is exactly where signups are won or lost. Owning the channel is what makes everything downstream of it work the way it’s supposed to.
