Getting password-reset emails from X you never asked for? Don't touch them

If your inbox filled up with "reset your X password" messages this week, you weren't alone and you weren't hacked. Starting 1 September, users of X, the former Twitter, reported unrequested reset emails and codes arriving one after another. X product engineer Mridul Singhai put it plainly: "Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts." He added that X had "found no evidence of any breaches."

What's going on is mechanical rather than clever. Anyone can type a public username into the forgot-password form, so someone is doing that at scale, and X sends the legitimate email each time. The timing is not a coincidence: X Money, the platform's payments service with a Visa debit card and peer-to-peer transfers for eligible US users, had just become broadly available, and an account with money attached is worth more than one without.

A flood of real reset emails is mostly a nuisance. The trap is the fake one hiding among them. When you're expecting these messages, a phishing copy that says "confirm this reset" with a link, or asks you to type the code into a page, looks perfectly reasonable. So: don't click anything in a reset email you didn't trigger, never enter a code anywhere except the app or site you opened yourself, and turn on two-factor authentication with an authenticator app rather than text messages. X also has a setting called Password Reset Protect under Settings and privacy, then Security; with it on, a reset needs more than your username.

Tendvane can't see your X account, but its Privacy and accounts check does the same kind of audit for the accounts on the PC itself: who can sign in, and whether each of them actually has a password.