.jpg)
X is investigating a wave of X password reset emails and confirmation codes that users never requested, though the platform says its initial review has found no evidence of a breach — a harassment campaign that appears timed to the expansion of X Money, which just made account control more valuable than ever.
X Product Engineering team member Mridul Singhai said the company was examining reports from users who received unexpected reset messages, some of them several in a row. An unsolicited reset email does not by itself mean an account password has been exposed — anyone can start the recovery process by entering an account username, email address or phone number, after which X sends a confirmation code. The danger comes later, if a user can be frightened or tricked into handing over that code. Singhai addressed the reports on X (Twitter):
X password reset settings can stop the flood
Under X's published security guidance, users can enable Password reset protection from the Security section of their account settings, which requires additional identifying information — an email address, phone number or both, depending on what is connected to the account — before X will send a reset link or code. That single toggle makes it far harder for a stranger to trigger repeated resets using only a public username. Two-factor authentication adds a second wall at login, with support for text messages, authentication apps and physical security keys depending on account type and subscription status.
Reset codes sent by email remain valid for 60 minutes, and completing a reset logs the account out of all active sessions. X advises users who repeatedly receive unrequested reset emails to enable both protections, to check that any login page uses the x.com domain before entering credentials, and to open the app or type the address directly rather than following email links. The platform says its legitimate messages come from addresses ending in @x.com or @e.x.com, contain no attachments and never ask for a password by email, direct message or reply. Anyone who entered credentials into an unfamiliar site should change the password, secure the linked email address and revoke unrecognized third-party apps.
X Money gives attackers a new prize
The timing is the story. The reset-email wave coincided with X expanding X Money to Premium and Premium+ subscribers with U.S. accounts, following its June debut with selected Premium+ users. The service offers deposit accounts, instant transfers between users, a Visa debit card, annual yields up to 6% and 3% cashback on X Card purchases, with Cross River Bank providing the banking infrastructure. Deposits held directly at an FDIC member bank qualify for standard insurance up to $250,000, and a cash sweep program can extend aggregate pass-through coverage up to $10 million — though X Payments itself is not a bank or an FDIC-insured institution.
An account attached to a payments balance, a debit card and deposit accounts is a juicier target than one holding a follower count. The same logic has driven years of SIM-swap attacks against crypto holders, and impersonation campaigns remain the industry's most reliable theft method. Despite Cross River's past work with Ripple, neither X nor the bank has announced crypto support within X Money — the service moves U.S. dollars through conventional banking rails — though X has separately explored stablecoin-based creator payments in internal discussions. The company has not disclosed who is behind the reset-request flood, how many accounts received them or whether the activity is automated.
For now, the practical advice is boring and free: turn on reset protection, turn on 2FA, never share a code you did not request. The attackers' theory — that X accounts are worth stealing now — is sound. The defense is two settings and thirty seconds.
