X Account Hacked and Email Changed? How to Recover It

You tried to log in to X and your password no longer works. The reset link goes to an email address you have never seen. Your handle may have changed too, and friends are asking about posts or crypto links you did not send.

You still have options, and the order matters. Your old inbox is the first place to look, because X sends a warning there when the email changes. After that, your phone number and X's hacked account support request are the official ways back.

This guide covers both cases (still logged in, or locked out), an attacker's two-factor authentication, and the scams aimed at people in this spot.

Last checked: 29 September 2026.

#What Should You Do If a Hacker Changed the Email on Your X Account?

Open the inbox that used to be on the account and find the email address change alert. X's account security tips say it sends one to the previous address every time the email changes. If any device is still logged in, change the password and email back straight away. If you are locked out, try "Forgot password?" with your phone number, then file X's hacked or compromised support request using the email that was on the account. In Malaysia, if money was lost, call 997 and your bank first.

#Is Your X Account Actually Hacked?

X's page on compromised accounts lists the signs. Any one of these is enough to act:

• Posts or Direct Messages from your account that you did not send.
• Follows, unfollows or blocks you did not make.
• A notice from X that your account may be compromised, or that your account information changed when you did not change it.
• Your password stops working and X asks you to reset it.

#Which Situation Are You In?

What you can still reach decides your route. Find your row, then read the matching section.

#Still Logged In Somewhere? Lock the Attacker Out

A phone or laptop that is still logged in is the best thing you have. Do these in order on that device, before the attacker notices:

1. Change the password in Settings and privacy. X's compromised account page says to use a strong password you have not used before.
2. Put your own email back in the account settings. X's guide to updating your email address says X then emails you a "Confirm now" button; tap it, or security features such as two-factor authentication stay unavailable.
3. Open "Apps and sessions". Under Sessions, choose "Log out all other sessions". X's third-party apps page notes this stops further posting from those sessions, although messages already cached on the attacker's device may stay there.
4. In the same section, revoke access for every connected app you do not recognise. X says to do this and change your password if you suspect a bad app.
5. Check Security for two-factor authentication. If a method is on that you did not set up, turn it off, then enrol your own. X's two-factor authentication guide lists text message, authentication app and security key.
6. Check the phone number and handle on the profile, and change back anything the attacker altered.

Then delete posts the attacker made. X's compromised account page also suggests scanning your computer for malware, especially if strange posts continue after the password change.

#Locked Out? Your Official Route Back

Being logged out everywhere is harder, but not always final. X's help pages lead back to one of two things: the original email or a verified phone number.

1. Search the old inbox, including spam, for the email change alert. Screenshot it with the date showing. It proves the account was yours and when it was taken.
2. If that inbox has also been taken, recover it first through Gmail, Outlook or whichever provider you use. X's page on email address access says to contact your email provider, then request a new X password once you are back in.
3. If your phone number was verified on the account, enter it on the password reset page. The same X page says you will be offered a reset by SMS.
4. If the reset fails, file the hacked or compromised support request. X's compromised account page asks you to use the email address associated with the account, and to include your username and the date you last had access. X then sends instructions to that email.
5. If the form asks you to verify a phone number, use the one that was on the account. X says that if the number was previously associated with the account, it will review the request and may re-add the number.

Use the email you had before the attacker's change, not their new one. X says it keeps previously used addresses for safety and security. If you are unsure which address you signed up with, our guide to recovering accounts after losing your email, phone or 2FA helps you find old sign-up evidence.

#The Hacker Turned On 2FA. Can You Still Get Back In?

Attackers often switch on two-factor authentication with their own app or key, so a password reset alone no longer lets you in. What you can do depends on whether any of your devices is still logged in.

• Still logged in on a device: go to Security, then Two-factor authentication, and turn off the method you did not add. X's guide shows each method has its own switch.
• Logged out, with a backup code you saved earlier: X's two-factor authentication help says you can log in with the backup code, then update your settings. Codes must be used in the order they were generated.
• Logged out, with no backup code: X says to contact support. For a takeover, that means the hacked or compromised request described above.

#Why X May Suspend a Hacked Account

X's page on suspended accounts says that if it suspects an account has been hacked, it may suspend it until it can be secured and restored to the owner. If prompts at login ask for a phone number or email confirmation, following them may unsuspend it. Otherwise, see our guide to X suspension appeals, or the one on X lock screens.

#How Did the Attacker Get In?

In plain terms, someone got your password, your email or a live login session. X's compromised account page names the usual causes: giving your login to a malicious app or website, a weak password, malware collecting passwords, or a compromised network.

Malaysian users often meet these as messages, in English, BM or Chinese. The wording below is illustrative, not quoted from a real message:

• A fake copyright or policy notice: "Your account will be suspended in 24 hours. Verify here." or "Akaun anda akan digantung. Sahkan di pautan ini."
• A "get verified" or "blue tick" offer that sends you to a login page that is not x.com.
• A Direct Message, even from a friend's hacked account, with an odd link: "Is this you in this video?" or "这是你吗？"

X's fake email page says X only sends email from @x.com or @e.x.com, never sends attachments, and never asks for your password by email. The security tips page adds that X will never ask for your password by Direct Message or reply, and that a real X login page always sits on x.com.

#What Not to Do While You Recover

• Do not reply to accounts that comment "DM this expert, he got my account back" under your posts. That is a common pattern for recovery scams.
• Do not pay "hackers for hire" or unban sellers. Breaking into an account is not a recovery route, and they usually take the money and disappear.
• Do not share your password, any login code or a backup code with anyone, including people claiming to be X staff.
• Do not use tools that claim to switch off someone else's two-factor authentication. They are not an official route.

#Warn Your Followers and Check Your Phone Line

Post a short warning from another account you control: your X account was taken, and nobody should click its links or send money. Our guide to hacked accounts messaging your friends has wording you can adapt.

If your phone suddenly shows "No service" or "SOS only", your number may have been moved to another SIM. Call your carrier from another phone, ask them to block the SIM and issue a replacement, and check your bank and email for SMS codes you did not request.

#If Money Was Lost or a Code Was Shared in Malaysia

Takeovers are often used for fraud, such as fake crypto giveaways or requests for money sent to your followers. The government's page on the NSRC 997 hotline says to call 997 within 24 hours of discovering a scam, contact the relevant bank and make a police report at the nearest police station. The hotline runs daily, 24 hours.

For the hacking itself, CyberSecurity Malaysia's Cyber999 service is the national point of contact for reporting computer security incidents. MyCERT's reporting channel page lists an online form, email to [email protected] and 1-300-88-2999 during office hours.

#Evidence to Gather Before You File

A clear, consistent request is easier to review. Collect these before you submit, and keep copies in one folder:

• Your handle, plus the new one if the attacker changed it.
• The email address that was on the account before the change.
• The email change alert or new login alert from X, with its date and time.
• The date and time you last had access.
• The phone number verified on the account, if any.
• Screenshots of the attacker's posts or messages, and of any suspension notice.

#Lock It Down Once You Are Back In

Recovery is not finished until the same trick cannot work twice. X's security tips suggest a short setup:

• A long, unique X password stored in a password manager, and an equally strong one for the email on the account.
• Two-factor authentication with an authentication app or security key, plus a backup code saved somewhere offline.
• "Password reset protection" switched on under Security, so a reset needs your email or phone number.
• Two-step login on the email account itself, since whoever holds that inbox can reset X.

#When Expert Recovery Help Makes Sense

Most people can follow the steps above alone. A second look can help when the account carries a business or a large following, when the email and phone were both taken, or when a support request has already been closed without a fix. SocialSafe by AwareXone, our recovery service, reviews the case first and tells you honestly which official route is still open, if any. We work only through X's own forms and processes and never ask for your password or codes. See how X account recovery works, and our Trust Center for what we will not do.

#Frequently Asked Questions