How to spot impersonation and fake X support accounts

Impersonation works because X shows the display name and profile picture first, and both can be set to anything. A scammer can look like X Support, your bank, a crypto project or your favorite creator within a minute. The things that are hard to fake sit one tap away, and learning to check them takes about ten seconds per account.

Read the handle, not the name

The display name is decoration. The @handle underneath is the unique identifier, and impersonators have to compromise on it because the real one is taken. Look for:

• Extra words: @XSupportTeam_, @Help_Twitter, @CopyrightX.
• Swapped characters: a zero for an "o", a capital "I" for a lowercase "l", "rn" pretending to be "m".
• Trailing numbers or underscores that the real brand would never use.
• A handle that has nothing to do with the name at all, like a support account called @jmk_8812. That usually means a hijacked or recycled account.

When a message claims to come from X, compare it with X's own accounts. X's official support handle is @Support, and the company's main accounts belong to X's verified organization. If you can't confirm a handle, assume it's not official.

Understand what the badges mean

X uses several checkmarks, and they mean different things:

Two warnings. First, a blue checkmark can be bought, so it tells you nothing about who someone is. Second, a hacked account keeps whatever badge it had. A gold-checked brand posting a surprise token launch is more likely compromised than generous.

The affiliation badge is the most useful one for support claims. A real X employee or X-run account usually shows an affiliation to X. Tap the small logo to see which organization it belongs to.

Look at the account's history

Open the profile and scroll for a few seconds:

• Join date. A "support" account created last month is not support.
• Post history. Real support and brand accounts have a long, boring archive. Impersonators often have a handful of posts, or old posts in a different language and topic, which suggests a bought or hijacked account.
• Follower pattern. Thousands of followers but no replies, or followers that all look like empty accounts, point to purchased numbers.
• Name and handle changes. If the account has an "about this account" panel, check whether the username was changed recently and where the account is based. A renamed account that suddenly speaks for a brand deserves suspicion.

Watch what they ask you to do

This is the most reliable test of all, because the request is the reason the impersonator exists. Real support from X, a bank or a wallet company won't:

• DM you first about a problem with your account and ask you to fix it through a link.
• Ask for your password, a login code, a backup code or a wallet recovery phrase. Ever.
• Ask you to move the conversation to Telegram, WhatsApp or a Google Form.
• Ask you to pay a fee to restore, verify or "unlock" an account.
• Ask you to install software, browser extensions or "verification tools."

If a message does any of these, you can stop checking. Close it, report it, and if it contains a link, you can paste it into the link explainer to see where it really goes.

The reply-guy scam

A very common variant doesn't wait for you to make the first move. Post anything like "my account got locked" or "my wallet isn't working" and within minutes you'll get replies from accounts named something like "Help Desk" or "Support Assistance" telling you to DM them. Some reference real company names. All of them are scams. The same applies to "account recovery experts" who reply to people who say they were hacked.

If you need help from a company, start the contact yourself from its official website or app.

When someone impersonates you or your brand

Impersonation of a person or brand in a misleading way breaks X's rules. To report it:

1. Open the impersonating profile, tap the three-dot menu and choose Report.
2. Pick the impersonation option and say who is being impersonated.
3. If you've been blocked, or you don't have an account, use the impersonation report form in X's help center at help.x.com.
4. Warn your own followers with a post that gives your real handle, and pin it for a while.

Brands with several team members should also read our guide to securing a shared business account, since an account that is consistently active and clearly connected to your website is easier for followers to tell apart from copies. If an impersonator is also publishing your personal details, see protecting high-profile accounts from doxxing.

A ten-second routine

Before you act on any message from an account that claims authority, check four things: the exact @handle, the type of badge and any affiliation, the join date, and whether the request is something real support would never ask. Most impersonators fail at least two of them.

Questions

TweetAttacks is independent and not affiliated with X Corp. Settings names can change when X updates its apps; if a menu has moved, search its name in X's settings.