Got a suspicious login alert from X? Six steps to take

Do not panic, but do not ignore it

The first reaction to a "your account logged in on a new device" alert is often panic. These emails are also used for phishing, so before clicking any link, confirm it really came from X. A genuine alert appears in in-app notifications and your bonded email, and it will not rush you to type your password or carry a suspicious short link. For the full response after a breach, see our data breach response steps.

Step 1: confirm if it was you

Open X login history and check whether the time and device match your own actions. Location display is often inaccurate, so do not be scared by a city name. Focus on the time and device model. If you just switched phones or used a new network, that alert was probably you.

Step 2: revoke strange sessions

From a trusted device, go to Account security, then Sessions, and sign out every device you do not recognize. Do this before changing the password so the intruder's old session dies and cannot act during the gap while you change the password.

Step 3: set a strong password

Use a password you have not reused elsewhere. Length matters more than a pile of symbols. After the change, every other session must re-verify, which invalidates old tokens at once. Do not reuse the new password on other services right after.

Step 4: turn on two-factor authentication

2FA blocks most automated hijacks. Prefer an authenticator app over SMS, because SMS is weaker under SIM-swap attacks. Keep backup codes in a separate offline copy, not on the same device as the account.

Step 5: audit authorized apps

Many hijacks gain access through third-party apps. In Account security, Apps and sessions, revoke every app you do not recognize or no longer use. Pay special attention to high-privilege apps that ask to read direct messages or post tweets on your behalf.

Step 6: do a post-check

Screenshot the alert and record the time and what you did. Next time a similar alert arrives, you can judge faster whether it is a false alarm or a real risk. If you cannot even receive a verification code by phone, see our account recovery without a phone.

For more account security topics, return to the homepage.