Quick answer
If you get a login alert for a device that wasn’t you, follow the steps in the alert and change your X password immediately. X says it never asks for your password by email, DM or reply, never asks you to download anything, and its login pages are always on https://x.com. Turn on two-factor authentication and Password reset protection (Settings and privacy > Account > Security).
Does this match what you see?
- You got a push or email alert about a login from a new device or place.
- You got an email saying your X email address changed.
- A DM, email or reply asks you to log in or verify your account through a link.
- You keep receiving password reset emails or codes you didn’t ask for.
iPhone & iPadAndroidComputer (browser)
Based on X Help Center “About account security”, supplied by the site owner, October 31, 2026.
Why this happens: the possible causes
What each alert or message usually means.
| What you got | What to do |
|---|---|
| New or suspicious login alert | Check it was you |
| Email-change alert | Act fast if it wasn’t you |
| Link asking you to log in | Check for phishing |
| Unrequested reset messages | Turn on reset protection |
- PhishingCheck this first
X says phishers try to trick you into giving your username, email or phone and password, usually through a link to a fake login page, often to send spam from your account.
- New device or browserCheck this first
X sends an alert the first time you log in from a new device, and every time if you use incognito or have cookies turned off.
Try these 60-second checks first
- Before typing your password, check the address bar shows https://x.com.
- Don’t open odd-looking links in DMs, even from friends.
How to fix it, step by step
Work through these in order. They start with the quickest, safest checks and only move to steps that sign you out or remove data later.
Fix 1: You got a login alert you don’t recognize
X says it sends a push notification or email when it detects a suspicious login, or the first time you log in from a new device, through the X apps, x.com or mobile web.
- Check whether it was you, for example a new phone, browser or incognito window.
- If it wasn’t you, follow the steps in the alert, starting with changing your X password immediately.
- Then log out other sessions and remove unknown apps, and secure the email on your account.
X says the location in the alert is approximate, based on your IP address, so it may not match where you actually are. If you log in from incognito or with cookies off, you’ll get an alert every time.
Did it work? Our check: your password is changed and only your devices are in Apps and sessions.
Did Fix 1 solve it?
Great, you fixed it with Fix 1. Tell us it worked, or bookmark this page in case it happens again.
Fix 2: Turn on Password reset protection
X says with this on, anyone requesting a password reset must enter your email address or phone number (or both, if both are on the account) first.
- Open the main menu > Settings and privacy > Account > Security.
- Turn on Password reset protection.
Our tip: turn it on if you keep getting password reset messages you didn’t ask for.
Did it work? Our check: the toggle shows as on.
Did Fix 2 solve it?
Great, you fixed it with Fix 2. Tell us it worked, or bookmark this page in case it happens again.
Email-change alerts
X says it emails your previous address any time the email on your account changes. If you didn’t change it, act right away: see someone else is using my account and change or confirm your email.
How to spot a fake X login page or message
- X says real X login pages are always on https://x.com (for example x.com or x.com/login). Phishing pages often look identical but are on a different address.
- If you’re unsure, go to x.com yourself and log in there instead of using the link.
- Short links (like bit.ly or TinyURL) can hide where they go. X says if a link unexpectedly takes you to something that looks like the X login page, don’t enter your details.
- X says if it suspects your account was phished or hacked, it may reset your password and email you an x.com reset link.
- Think you entered your password on a fake page? X says change it as soon as possible and follow the compromised account steps.
Is that email really from X?
- X says it only sends emails from @x.com. It never sends attachments and never asks for your password by email, Direct Message or reply.
- Look for the blue checkmark: X says that in early June 2026 it added a Mark Certificate to all its emails. Most major email apps show a blue checkmark next to the sender, meaning the sender has verified they own x.com and the logo. X says don’t engage with emails missing it.
- Fake emails can look very convincing, or even appear to come from an X address. X says you can check the email’s headers to see where it really came from, and be suspicious of new or unexpected emails.
- X says if it resets your password because it thinks you were hacked, the reset link is always on https://x.com.
If you get a fake email
- Delete it from your inbox.
- Don’t download attachments or click its links.
- Clicked a link and entered your password? Change it right away and follow the compromised account steps.
X says it doesn’t send these emails. It points to the US Federal Trade Commission’s consumer site (external site, opens in a new tab) for ways spammers may find your email address.
Two-factor authentication and the text-message change
X says two-factor authentication means only someone with both your password and your phone (or a security key) can log in.
Password tips from X
- At least 10 characters, mixing upper and lower case, numbers and symbols. Longer is better.
- A different password for X and for the email on your account; don’t reuse passwords elsewhere.
- No personal details (birthdays, phone numbers), common words like “password”, or sequences like “abcd1234” or “qwerty”.
- A password manager can store them safely.
- Keep your browser and computer updated, scan for viruses, and sign out on public computers.
How to know it worked
- Our check: two-factor and Password reset protection are on, your passwords are unique, and no unknown sessions or apps remain.
Still not working? Your next steps
- Already locked out? See can’t log in to X.
Official help routes
SocialAppFix can’t see or change your account. For account decisions, recovery and appeals, only the platform’s own tools can help. These links go to the official sites.
Frequently asked questions
Does X ever ask for my password by email or DM?
No. X says it will never ask for your password by email, Direct Message or reply.
How can I tell if an email from X is real?
X says it only emails from @x.com, never sends attachments, and never asks for your password. Since early June 2026, real X emails show a blue checkmark next to the sender in most major email apps; X says don’t engage with emails missing it.
Why does my X login alert show the wrong city?
X says the location is approximate, based on your IP address, so it can differ from where you are.
Why do I get a login alert every time?
X says if you log in from incognito browsers or with cookies turned off, you’ll get an alert each time.
Can I still use text messages for X two-factor?
X says text-message two-factor has only been supported for Premium subscribers since March 20, 2023, and may vary by country and carrier.
Did this solve your problem?
Your answer stays in your browser — nothing is sent or stored. The “tell us” link opens your own email app.
Out of date or didn’t work? Email us — never include passwords or codes.
Sources and how we checked this guide
We base steps on the platforms’ own help pages and the phone makers’ official guides. Menu names change often and can differ by device, app version and region. Where a platform page could not be independently read, we link it so you can check the current wording yourself.
- About fake X emails (external site, opens in a new tab)
- About account security (external site, opens in a new tab)
Last reviewed 31 October 2026 by the SocialAppFix editorial team against the sources above. Next scheduled review: 31 January 2027. How we write and review guides.
What changed
- 31 October 2026: First published.
- 31 October 2026: Added fake X emails section (sender checkmark, attachments, headers).
SocialAppFix is an independent guide and is not affiliated with or endorsed by X Corp.. We never ask for passwords, login codes or payment to fix an account.