Recovering a Hacked X Account: 5 Frequently Asked Questions

Start here if you still have access

If you can log in, do four things in order: change the password, restore the recovery email and phone to ones you control, revoke every third-party app permission, and turn on two-factor authentication. That sequence stops the attacker from walking back in.

If you are fully locked out

Use the account recovery flow and verify your identity. Have former emails and your signup period ready. Manual review can take a few days, so start it as early as you can and avoid paying any scam that promises instant recovery.

After you get it back

Review what was posted during the takeover and delete the attacker's ads. Audit authorized apps, confirm the recovery email and phone were not changed away, then enable two-factor authentication if it is still off.

Lower the odds next time

A unique strong password plus two-factor authentication removes most takeover risk. Add two habits: do not click unfamiliar login links, and review authorized apps every few months. For a wider plan, our guide to backup codes and the passkey FAQ cover the stronger options.

When to contact X support directly

If recovery stalls for more than a week, or if the attacker changed the account email to an address you cannot reach, open a support ticket with the former login email and any purchase receipts. Proof of past activity shortens the wait far more than vague descriptions ever will, so gather screenshots of old tweets and billing emails before you write in.

Put this on a calendar

Recovery is easier when you notice fast. Set a recurring reminder to check login devices and authorized apps every quarter. The first sign of trouble is usually a device you do not recognize, and catching it early turns a nightmare into a ten-minute fix. Worried about what the attacker saw? Run a free on-device footprint check to see what personal details your old tweets already expose.