Phishing DMs That Pretend to Be X Support: Seven Signals and What to Do

Phishing DMs that pretend to be X support share one trait. They do not attack your technical setup, they attack your sequence. Follow the steps once and the account is gone. Once you see it that way, spotting them gets easier, because you no longer have to judge how convincing the page looks. You only have to judge whether the official channel would ever ask for this in this way.

Seven signals you can check one by one

1. A DM that asks you to verify. Official flows put verification inside settings or the notification centre, where you go and look, not in a message that comes to you.
2. A deadline. Wording like within 24 hours exists for one purpose: to compress the time you spend checking.
3. A domain that is not the real one. Hover or long-press to see the actual address, and read the main domain rather than words in the path.
4. A request for a password or a code. Any page asking you to hand over a verification code can be treated as phishing immediately, because the point of a code is that it cannot be forwarded.
5. A handle with extra characters. An added digit or a doubled letter in the handle is the standard pattern.
6. A very short history. Open the profile and look. Account age and post count usually settle it in seconds.
7. A push to move elsewhere. Being asked to continue on a messaging app or by email means leaving the platform's abuse detection behind.

Any single one of these is thin on its own, but two together are reason to stop. When the third and fourth hit at the same time, the case is closed.

Why these messages look credible

Three factors stack. The handle and avatar can be made nearly identical to the official account, which is cheap to do. The copy cites features that really exist, such as verification badges, copyright appeals or unusual login alerts, so it sounds reasonable. Then time pressure supplies a short deadline.

The combined effect is that people skip verification and jump straight to solving the problem. That state is what phishing actually exploits, not the technical quality of the page.

What to do after you clicked

If you opened the link at all, treat it as a live exposure, because some pages try to read session data as soon as they load. Order matters more than the individual actions.

1. Change the password from another device. Work from a device that is not sharing the affected session.
2. Sign out other sessions. Open the active session list in settings and sign out anything you do not recognise, covered in auditing logged-in devices.
3. Revoke connected apps. Go through the authorisation list and cut unknown grants, described in connected app permission audit.
4. Confirm two-factor. Make sure it is on and tied to something you physically hold, per enabling two-factor.
5. Check the profile. Confirm the email, phone number and bio are unchanged, since those are touched first.

Do not add extra steps. The common first reaction is to search whether the message is real, and that search tends to surface more pages of the same kind, which raises your exposure rather than lowering it.

Recovery order after a takeover

A takeover means someone is already using the account. The order is recover, harden, clean.

Phase	Actions	Done when
Recover	Official password reset, confirm email and phone are yours	You can log in reliably and hold the verification channel
Harden	New password, sign out other sessions, revoke grants, enable two-factor	Session and authorisation lists contain only what you recognise
Clean	Review posts, messages and profile changes	Nothing on the account belongs to someone else

The recovery phase hinges on email and phone. Attackers usually change those two first, and if they are not in your hands, every later hardening step can be bypassed. The full flow is in account takeover recovery, and the phone-based variant is covered in SIM swap attacks.

A fixed sequence beats a memorised list

The signals keep changing. A fixed process does not. Three rules cover most cases. Never complete a verification that arrives through an external link. Never hand over a code. And when a message applies a deadline, put it down for an hour before touching it. None of these require you to judge authenticity, only to keep your order intact.

One related point: account security and content cleanup point in the same direction. Removing phone numbers and email addresses from old tweets lowers the odds of targeted phishing in the first place, and the filtering approach is in finding tweets with phone numbers and handling an email leak.

About Digital Footprint Health

Digital Footprint Health (digital-footprint-health.shop) handles the other half: how much of your history is usable for targeting. Upload your X data archive and the tool parses every tweet and media file on your own device, returning a score from 0 to 100 and flagged items grouped by category. It is read-only, uploads nothing and never asks for account access. For the security checklist side, see permission audits, and for long-term upkeep see the 30-day habit plan. Scope and pricing are on the pricing page, the free check starts on the homepage, and the rest is on the blog.