Free WhatsApp bulk sender: why free costs you your number
By José Pedro · Co-founder of CRPRO
The software is free; your number is the collateral. See how free WhatsApp bulk senders work under the hood, how Meta's detection signals actually behave, what the official API gives you that they don't, and what to do instead.
A free WhatsApp bulk sender is a program that latches onto a regular WhatsApp session — through a QR code, a browser extension, or automation on the phone itself — and starts sending bulk messages under the number's owner, through the same channel as a personal account. The software is what's free; the number is what goes in as collateral, because this path has no template review, no quality rating, and no warning before the penalty.
How much does a free bulk sender actually save?
Pretending free saves nothing would be dishonest. It saves a lot.
Sending through the official API is billed per delivered template message. In Brazil, a marketing message runs about US$0.0625 — somewhere near R$0.32 (Meta's rate in effect as of August 2026).
| Marketing campaign | Meta's rate on the official API (August 2026) | Free bulk sender |
|---|---|---|
| 1,000 contacts | ~R$320 | R$0 |
| 5,000 contacts | ~R$1,600 | R$0 |
| 20,000 contacts | ~R$6,400 | R$0 |
The savings are real. That's why the right question isn't whether it's worth saving money, but: what's being put up as collateral for that savings?
How does a free WhatsApp bulk sender work under the hood?
There are three families of tool, and none of them is an integration authorized by Meta.
| Family | How it connects | Typical promise | Where it runs |
|---|---|---|---|
| Browser automation | An extension opens WhatsApp Web, pastes the text, clicks send, and moves to the next contact on the spreadsheet | "Installs in minutes" | On your machine, as long as the tab stays open |
| Unofficial protocol library | A reimplementation of the WhatsApp Web protocol: the program pairs as if it were another device on the account and sends without opening a screen | "10,000 sends a day" | On a server, with a session active 24 hours a day from a datacenter IP while the registered device sits on your desk |
| Device automation | An accessibility service or an ADB script tapping the screen of an Android phone | "More human" | On the physical phone, with synthetic taps at machine cadence |
None of the three go through sender registration, a contract, or an approval screen. All three come in through the door of a personal account.
No free bulk sender goes through Meta's review
What unites all three families is the connection: all of them send through the regular connection, the same one a personal account uses. None of them go through an approved template, none of them generate a quality rating, none of them trigger a warning email.
The problem isn't that the free tool is worse than the paid one — it's that the entire channel it operates on has no instrumentation. With no approved template there's no review before sending; with no quality rating there's no temperature gauge; with no warning email there's no yellow before the red.
And if there's a modified app in the mix — GB WhatsApp, WhatsApp Plus, and relatives —, then it's no longer just about bulk sending: the entire app violates the Terms.
How does Meta detect bulk sending?
Meta doesn't publish its detection model, and anyone claiming to know it in detail is guessing. What can be described is the trail the operation leaves — and it's a trail no person would ever produce.
Clockwork cadence. People don't send messages at constant intervals — and "random between 8 and 20 seconds" for six straight hours is still a distribution that doesn't exist in the real world.
Outbound ratio. A conversation has back-and-forth. Bulk sending has 500 outbound messages against a dozen inbound — a ratio that doesn't resemble anything organic, and it's visible without anyone reading what you wrote.
Recipients with no history. Every send opens a thread created in the same minute, with someone who's never talked to you. At volume, that doesn't happen by chance.
A brand-new number with high volume. It's the "burn one, make another" recipe: register today, send 2,000 tomorrow. A new number is the most fragile profile there is.
Delivery that doesn't happen. A scraped or purchased list has wrong numbers, deactivated ones, or ones that never had WhatsApp. At scale, that turns into a pile of messages stuck on a single checkmark — the signature of a cold list.
What turns suspicion into a ban?
The signals above are suspicion. Blocks and reports are the sentence.
The "Report" button on conversations from strangers is the strongest input in the chain, and cold bulk sending maximizes exactly that: a message nobody asked for, a sender with no history, a report one tap away. A spike in reports in a short window ends the discussion — there's no "safe" volume that offsets a high report rate. A block is quieter, because nobody tells you that you got blocked, but the signal arrives the same way.
What Meta classifies as spam is covered in WhatsApp banned for spam.
What do you lose when the number gets banned?
Here the math from the table above flips upside down.
The number isn't a form field. It's on the Google Business Profile, in the Instagram bio, in the site footer, on the business card, and in the Click-to-WhatsApp ad running right now. A permanent ban doesn't give any of that back.
What goes with it:
- The history. Every conversation, every bit of context about a longtime customer, every agreement that was documented in the chat.
- The paid traffic pointed there. An ad that opens a conversation on a dead number is spend delivered to a closed door, and the door doesn't announce it closed.
- The visibility into who tried. A customer who reaches out gets silence — and you never find out they came.
- Time. On the regular app and on Business, the appeal is a form and a wait with no published deadline.
And the aggravating factor: on the regular app and on Business, Meta can ban with no advance warning. There's no yellow before the red. If it's already happened, the recovery roadmap is here.
What does the official API give you that a free bulk sender doesn't?
Let's be clear, because a lot of pages promise something that doesn't exist: the official API doesn't eliminate ban risk. Meta keeps the field waba_ban_state in the account_update webhook, and an attempted send on a blocked account returns error 368. A field like that wouldn't exist if there were no bans.
What changes is visibility and due process:
| Criterion | Free bulk sender over QR code | Official API |
|---|---|---|
| Per-number quality rating | Doesn't exist | Green, yellow, or red, calculated on a weighted basis over the last 7 days |
| Warning before the penalty | None | Email to the admin when the score drops |
| Penalty | One step only: banned | Escalated — the account is restricted before it's banned |
| Appeal | A form, no published deadline | A formal process through Business Manager |
| Sending outside the 24h window | Nothing stops it | Impossible: returns error 131047 |
| Cost per message | R$0 | Charged per delivered message (US$0.0625 for marketing in Brazil, August 2026) |
The window row deserves a highlight: on the official API you can't send a message outside the 24-hour window — the call fails, and only an approved template reopens the conversation. On QR code, nothing stops you. And that's exactly where the report is born.
The honest point: QR code isn't the villain
CRPRO sells both paths — the official API and the QR code connection —, and that's why this can be said without spinning the argument: the problem isn't QR code, it's the pattern.
A QR code connection handling a conversation the customer started, at a human pace, with opt-in and an easy way out, carries a completely different risk than that same connection spitting out 3,000 cold messages a night. Same technology, opposite outcome. What a free bulk sender sells isn't the connection — it's the pattern that burns it down.
If your operation is conversation and follow-up with people who already talked to you, QR code holds up fine. If it's active campaigns to a large base, the path is an approved template on the official API — and it's worth reading when not to migrate before switching on reflex.
What to do instead of a free bulk sender
- Ask for permission and log the source. The policy requires contacting only people who gave their number and gave authorization. The source of each contact is what saves you in an appeal.
- Segment before writing. A campaign to "everyone" looks like spam even when it isn't.
- Give an easy way out and honor it. Whoever leaves through the door doesn't report you. An ignored opt-out is the shortest route to a report.
- Start small and watch the response. If replies dry up and blocks show up, the problem is the list or the copy, not the volume.
- Have someone answering. An open, abandoned conversation turns into a report. The campaign step-by-step is in bulk sending on WhatsApp.
What changed on October 1, 2026?
One calendar detail changed the math. Until September 30, 2026, replying inside an open window was free. Since October 1, 2026, Meta charges per message for service messages and utility templates sent inside the 24-hour window. The service rate is in Meta's current price table — anyone quoting a figure without citing it is making it up. The impact is in the anti-ban playbook got a price tag.
If you want to compare the two paths against your own list, CRPRO connects QR code and the official API on the same platform — you can start wherever it makes sense and switch later.
Frequently Asked Questions
Does a free WhatsApp bulk sender actually work?
It works in the sense of delivering messages — until it stops. And that's what tricks people: the immediate result exists, and the penalty arrives later, with no obvious link to the campaign that caused it.
Does using a free bulk sender ban the number instantly?
No, and that's the problem. The first campaign usually goes through, so does the second. The signal accumulates through reports and blocks, and by the time the penalty arrives it comes in at the highest step — on the regular app, with no advance warning.
Does the official API prevent my number from getting banned?
No. A number on the official API can be banned; Meta keeps the waba_ban_state field in the webhook and error 368 for a blocked account. What the API gives you is what QR code doesn't have: per-number quality rating, calculated on a weighted basis over the last 7 days, a written warning to the admin, escalated penalties, and a formal appeal through Business Manager.
How many marketing messages can I send per day to the same customer?
There's no published number. The limit is adaptive, calculated per user and per business, and changes based on engagement. Anyone quoting "2 per day" is repeating a figure Meta doesn't disclose. Exceeding the limit returns error 131049.
Does WhatsApp Business's broadcast list solve this?
It's safer than an unofficial bulk sender and a lot more limited: a cap of 256 contacts per list (limit in effect as of August 2026) and delivery only to people who have your number saved in their contacts. It works for a notice to a small, loyal base, not for a campaign. Details in broadcast list.
I lost the number to a permanent ban. Do I get the history back?
If the appeal is accepted, the account comes back. If it's denied, the number and everything that was in it don't come back — which is why what matters needs to live outside the device, in a CRM, before any campaign.