{"id":557092,"date":"2026-07-19T06:54:11","date_gmt":"2026-07-19T06:54:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/557092\/"},"modified":"2026-07-19T06:54:11","modified_gmt":"2026-07-19T06:54:11","slug":"we-noticed-a-login-from-a-new-device-the-message-from-fraudsters-targeting-your-x-account-scams","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/557092\/","title":{"rendered":"\u2018We noticed a login from a new device\u2019: the message from fraudsters targeting your X account | Scams"},"content":{"rendered":"

You have had an X<\/a> account for years, since it was known as Twitter. When an email arrives about a new login from a location nowhere near where you live, alarm bells begin to ring.<\/p>\n

\u201cWe noticed a login to your account from a new device. Was this you?\u201d the email asks.<\/p>\n

The location is Arizona, but you live in London. The device is \u201cFirefox Desktop on Mac\u201d.<\/p>\n

\u201cIf this wasn\u2019t you,\u201d the email continues, \u201ccomplete these steps now to protect your account.\u201d<\/p>\n

The steps include clicking a link to change your password, which will end up with you \u201clogged out of all your active X sessions except the one you\u2019re using at this time\u201d and to click another link to review the apps that have access to your account and revoke any that are unfamiliar.<\/p>\n

The steps are legitimate advice from X, but the links to reset your password, or to review app access are not. The email is fake and attempting to trick you into giving scammers your password, or direct access to your X account.<\/p>\n

\u201cScammers want your X username and password, or to trick you into approving a malicious link that gives them access to your account without needing your password,\u201d says Jake Moore, a global cybersecurity adviser at ESET.<\/p>\n

Once the criminals have access to your account they will more than likely use it to attempt to commit further fraud including crypto scams, phishing attacks and misinformation campaigns.<\/p>\n

What it looks like<\/p>\n

The fake emails are almost an exact replica of legitimate login notifications sent by X. They include the X logo, and the same formatting, colours and copy, with correct grammar and spelling.<\/p>\n

Spot the difference: a scam email pretending to be an X new device login notification (left) next to a legitimate notification (right). Composite: Samuel Gibbs\/The Guardian<\/p>\n

Small telltale signs show the email is not legitimate, such as not including your X account handle, and being vague on the location of the login.<\/p>\n

\u201cThe two biggest giveaways are the email address it comes from, and where the links actually take you,\u201d says Moore.<\/p>\n

The social media site says<\/a>: \u201cX will only send you emails from @X.com or @e.X.com\u2026 Please know that X will never send emails with attachments, or request your X password by email \u2026 and will never ask you to provide your password via email, direct message or reply.\u201d<\/p>\n

If you do click on a link in the email, you will be brought to a fake website designed to steal your password, or to authorise a scammer\u2019s app to access your account directly, often under the guise of a tool for performing a \u201csecurity audit\u201d or \u201ctroubleshooting\u201d.<\/p>\n

What to do<\/p>\n

\u201cIf you ever receive an email like this, it is very normal, but remember not to panic, and don\u2019t click the links to divulge any personal data. Instead, open the genuine app, and if there really is a security issue, you\u2019ll see it there,\u201d Moore says.<\/p>\n

Check the email headers and URL links to ensure they are from the X.com domain. You can report fraudulent emails to your email provider using the built-in spam and phishing tools.<\/p>\n

\u201cIf you clicked on a link, and only opened the page, you\u2019re probably fine,\u201d Moore says. \u201cBut if you have ever entered your password, or a one-time passcode to a web address you didn\u2019t check, change your password immediately and double-check you have two-factor authentication turned on.\u201d<\/p>\n

If you suspect your X account has been compromised, follow the social media site\u2019s help guide<\/a>. The company says it may reset the passwords of any account it believes may have been hacked, and will send a secure link sent via email to select a new password.<\/p>\n","protected":false},"excerpt":{"rendered":"You have had an X account for years, since it was known as Twitter. When an email arrives…\n","protected":false},"author":2,"featured_media":557093,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-557092","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/557092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=557092"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/557092\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/557093"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=557092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=557092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=557092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}