Unfamiliar Login Alert on X? Five Questions to Settle First

When X reports a sign-in from a new device, the easiest move is to kill every session at once. That move is not wrong, but doing it first throws away the evidence you need: when the sign-in happened, where it came from, and whether anything else on the account changed during that window. The five questions below take about fifteen minutes in total.

1. Is the alert genuine?

Phishing emails and push notifications copy the look of a login alert so that you click through to a fake sign-in page. There is one reliable check: do not use the link in the alert. Open the X app yourself or type the address, sign in, and read the session list in settings.

If no unfamiliar entry appears in the real session list, the alert was fabricated. Messages like that usually arrive alongside phishing DMs.

2. Where did that session start from?

Settings holds the device and session list under security and account access, showing an approximate region, the client type and the last active time. Check your own habits first. Corporate networks, campus Wi-Fi, VPNs and airport networks all register as unfamiliar locations.

The test is not an unfamiliar city, it is an unfamiliar device and client. The login device audit walks through checking each entry.

3. What changed on the account during that window?

The alert is an outcome. What you actually need to establish is whether the sign-in left actions behind. Walk through these: posts published, profile details edited, apps authorised, privacy settings changed, and following list edits. The checklist is laid out in more detail in the connected-apps permission audit.

4. Change the password first, or kill sessions first?

Order it as: new password, then sessions, then two-factor. Changing the password invalidates other sessions, so one step does both jobs. Immediately after that, confirm that two-factor authentication is on and still bound to a method you control.

If the second factor has been switched to an unknown phone number or authenticator, whoever did that holds enough access to treat this as a takeover, and the recovery walkthrough covers that case.

5. What still needs doing afterwards?

Replace the password with a generated one that is not reused anywhere else. Then check the email account itself, because email is the entry point for password resets; if the mailbox is controlled, no number of X password changes will help. The password manager walkthrough has the setup steps.

Worth doing while you are there: review where you normally sign in from. Frequent logins on shared networks or shared devices produce a steady stream of alerts, and familiarity with that noise is what hides the one that matters.

Common questions

The device in the alert is an old phone I already sold. Anything to do?

Yes. Kill that session and change the password, since the session was created while the device was still yours and may still be valid.

The alert says my account is locked and asks me to click a link. Real?

The rule does not change: skip the link and open the app yourself. A genuine lock state is visible inside the app.

I changed the password but the unknown session is still listed.

Re-read the session list, sign out the remaining entries one by one, then confirm the second factor is bound to a method you control.

About digital-footprint-health.shop

Account security decides whether the content you deleted can come back. To see which old posts deserve attention first, start with a check: upload your X archive at the homepage and the scan runs on your own machine, returning a list sorted by risk. Free and read-only; cleanup scope and pricing are on the pricing page, and security write-ups sit in the blog index.