Do this today, not after something goes wrong. A taken-over account is typically used to send scam links to your followers, and recovering it is slow. The ten checks below take about 15 minutes in total.
| # | Check | Where in X | Minutes |
|---|---|---|---|
| 1 | Password is unique to X | Settings, Your account, Change your password | 2 |
| 2 | Two-factor authentication is on | Settings, Security and account access, Security | 3 |
| 3 | Backup code is saved offline | Same screen, after turning 2FA on | 1 |
| 4 | Email address is current | Settings, Your account, Account information | 1 |
| 5 | The email account has its own 2FA | Your email provider | 3 |
| 6 | Password reset protection is on | Settings, Security and account access, Security | 1 |
| 7 | Unknown connected apps are removed | Settings, Security and account access, Apps and sessions | 2 |
| 8 | Old sessions are logged out | Apps and sessions, Sessions | 1 |
| 9 | Delegated access is reviewed | Settings, Security and account access, Delegate | 1 |
| 10 | You know what a phishing message looks like | See the list below | 0 |
Menu names change from time to time. If a path above does not match your app, search the settings for the word in the Check column.
Check 2 in detail: which 2FA method
X offers three methods, according to its Help Center: text message, authentication app and security key.
| Method | How the second step arrives | Weak point |
|---|---|---|
| Text message | Code sent by SMS | Depends on your phone number staying under your control |
| Authentication app | Code generated on your phone | Lost phone, if you have no backup code |
| Security key | Physical key you plug in or tap | Losing the key, if it is your only method |
An authentication app or a security key does not rely on your phone number. Whichever you choose, save the backup code X gives you and keep it somewhere that is not your phone.
Check 10 in detail: warning signs
- A message says your account will be suspended unless you act within hours.
- A link leads to a login page whose address is not x.com.
- Someone offers verification, followers or a brand deal and asks you to “confirm your account” first.
- A direct message from a friend contains only a link and a line such as “is this you?”.
- Anyone asks for your password or a login code. X staff do not need them.
If you already typed your password into a page you now doubt: change it at once, log out all other sessions and review connected apps.
Two follow-ups
What if I lose the phone with my authentication app?
Use the backup code to log in, then set up 2FA again on the new phone. This is the reason for check 3.
How often should I repeat the checklist?
Every six months, and straight after any login alert you did not cause.