Securing a Compromised X Account While Still Logged In

Is this your situation?

Do this first

Which situation is yours?

• Unintended Direct Messages were sent from the account.
• Your password no longer works and prompts a reset.
• You changed the password but apps still show you logged in.
• Delete any unwanted posts that were posted while the account was compromised.
• A trusted third-party application still uses your old X password.
• Unauthorized behavior continues after you changed the password.
• Two-factor authentication introduces a second check beyond a password to ensure only the account owner can access the account.

How X handles this

• A third-party application bug can also cause unexpected account behavior, not only compromise.
• Changing the password and revoking connections stops behavior caused by an app, since it loses access.
• If you're logged out, go to Login and click Forgot Password to reset it.
• Make sure the email address attached to the account is secure and only you have access to it.
• Users of the teams feature in X Pro should check the members list for users they don't recognize.

Which recovery path is yours?

1. You receive an email from verify@x.com about an email address change you did not make. You can reverse this by clicking the provided link in the email.
2. You can still log in but see posts or messages you did not send. Change your password from the Password tab in settings.
3. A trusted third-party application uses your X password. Update your password in that application.
4. You notice unauthorized behaviors continuing after you changed the password. Scan your computers for viruses and malware.
5. You still cannot log in after trying a password reset. Contact support by submitting a Support Request.

What not to do

• Assuming the password change logs out other apps Changing the password does not automatically log the account out of the iOS or Android applications.Why it happens: You expect a password change to end every session everywhere.
• Reopening a trusted app without updating its password If a trusted external application uses the X password, update it there too.Why it happens: Failing to update it may temporarily lock you out of your account from failed login attempts.Already happened: Check the app's saved password and update it there.
• Not revoking unrecognized applications A user should visit Apps in settings while logged in to revoke access for any application they don't recognize.Why it happens: You assume a password change alone removes every app's access.

What to have ready

• Password tab access Confirm you can reach the Password tab. Change your password from the Password tab in settings.
• Apps list Check connected applications. Visit Apps in settings to revoke access for apps you don't recognize.
• iOS or Android sessions Check whether app sessions are still logged in. A password change does not log out iOS or Android apps.
• Associated email address Check the attached email is secure. Make sure only you have access to the attached email.
• Trusted third-party app passwords List any trusted app storing your X password. Update the password in any trusted app that uses it.
• Posts made during compromise Review recent posts you did not make.

Stop this happening again

Quick reference

Keeping track of who has access