X is investigating a wave of unexpected password-reset emails and confirmation codes, but says its initial review has found no evidence that the platform’s systems have been compromised.
Mridul Singhai, a member of X’s Product Engineering team, said on Tuesday that the company was examining reports from users who had received reset messages they had not requested. At the time of his statement, he said X had not identified any breach of its internal systems.
Several account holders reported receiving one or more messages despite making no attempt to change their login details. In some cases, users said they had received repeated reset requests, prompting concerns that an unknown party might be trying to gain control of their accounts.
However, receiving an unsolicited reset message does not in itself prove that a password has been exposed or that an account has been accessed.
X’s recovery process allows anyone to begin a password reset by entering an account username, email address or phone number. The platform then sends a confirmation code to the contact method registered with the account.
X has advised users not to share a reset code or approve a password change they did not initiate. Singhai also recommended enabling two-factor authentication and avoiding links contained in unexpected emails.
He said attackers appeared to believe that expanded access to X Money could increase the value of taking control of X accounts. X has not said who may be behind the reset requests, how many accounts have been affected or whether the activity is part of an automated campaign.
How users can protect their accounts
X’s account-security guidance includes a feature called Password reset protection, which can be enabled through the Security section of the account settings.
When activated, the feature requires additional identifying information before X sends a password-reset link or confirmation code. Depending on the details associated with an account, users may have to provide an email address, a phone number or both.
The extra checks are intended to make it more difficult for an unknown person to repeatedly trigger reset requests using only a publicly available username.
Two-factor authentication provides another layer of security when a user logs in. X supports authentication by text message, authentication application and physical security key, although the available options can vary according to account type and subscription status.
Under X’s password-recovery instructions, codes sent by email remain valid for 60 minutes. Completing a password reset signs the account out of all active X sessions. By contrast, changing a password while already logged in leaves the session used to make the change active.
X specifically recommends that people who continue to receive reset emails they did not request turn on both Password reset protection and two-factor authentication.
The company also advises users to check that any login page uses the x.com domain before entering their credentials. Rather than clicking a link in an email, account holders can open the X application or type the platform’s address directly into a browser to inspect their account settings.
According to X, genuine emails are sent from addresses ending in @x.com or @e.x.com. They do not contain attachments and will never ask users to provide a password by email, direct message or reply.
Anyone who has entered login details into an unfamiliar website should change their password through X, protect the email address linked to the account and remove access for any unrecognised third-party applications. X also advises choosing a password that is not used on other services.
Reports coincide with X Money expansion
The reports of password-reset messages emerged as X expanded X Money to Premium and Premium+ subscribers with accounts in the United States.
X Money allows eligible users to send money to one another without leaving the social media platform. Its banking infrastructure is provided by Cross River Bank.
As previously reported by crypto.news, the service includes deposit accounts, instant transfers and a Visa debit card. It also offers annual yields of up to 6%, while eligible purchases made with the X Card can generate 3% cash back.
Cross River holds customer deposits and connects X Money to the banking networks used for transfers. Deposits held directly at a bank that is a member of the Federal Deposit Insurance Corporation may qualify for standard FDIC insurance of up to $250,000, subject to the agency’s rules.
X Money also operates a cash-sweep programme that distributes funds among participating insured banks. Eligible customers may receive aggregate pass-through FDIC cover of up to $10m, although X Payments is not a bank and is not an FDIC-insured institution.
The service uses passkeys for authentication and gives customers the ability to set transaction limits and require additional approval for certain payments. Visa supplies security and risk-management measures for purchases made through the X Card.
Access was initially restricted to selected Premium+ users when the payment service began using Cross River’s infrastructure in June. X later included Premium subscribers as availability expanded across the US.
Despite Cross River’s previous work with Ripple, neither X nor the bank has announced support for XRP or any other cryptocurrency within X Money. The service currently transfers US dollars through conventional banking and card networks.
X’s plans for financial services extend beyond person-to-person payments. In August, the company was considering USDC payments and other stablecoins as possible options for creator rewards, according to a person familiar with the discussions.
At the time of that report, no token, blockchain network or launch date had been chosen. X had also not said whether creators would receive stablecoins automatically or be able to select them instead of bank payments.
Those discussions took place before the platform’s planned replacement of its Revenue Sharing programme with Original Content Rewards on 8 September. Under X’s announced eligibility criteria, creators must have at least 500 verified followers and 500,000 Home Timeline impressions from verified users during the previous 90 days.
X has not confirmed that digital assets will be introduced to X Money. The payment service remains available only to eligible subscribers in the US, and the company has not provided a timetable for access by free users or people outside the country.
