Got fake X login alert? Here's how to spot the scam

You've had an X account for years, since it was still called Twitter. Then an email lands: a login from Arizona on Firefox Desktop on Mac, except you live in London and haven't touched a Mac in months.

The scam email replicates X's real login alerts down to the logo, colours, formatting and grammar. It even repeats X's own genuine advice: change your password, log out of other sessions, and review connected apps. The instructions are real. The links attached to them are not.

"Scammers want your X username and password, or to trick you into approving a malicious link that gives them access to your account without needing your password," says Jake Moore, global cybersecurity adviser at ESET.

In most cases, once the hacker gains access to an account, the person usually uses the hijacked account to commit crypto fraud, phishing attacks or even spread false information using the compromised account to perpetrate additional fraud.

"The two biggest giveaways are the email address it comes from and where the links actually take you," explains Moore.

According to X, it only sends emails from either @X.com or @e.X.com without any attachments and would never ask for your password via email, direct message or reply.

What to do if you get X fake emails?

Avoid clicking anything. Open the X app to see if there’s anything there as well. Make sure that the sender’s email address is legit and check the link before clicking on it.

If you have entered your password or one-time code on an unknown website, reset the password and make sure that the two-factor authentication is enabled.