How to fix the unusual activity message on your Twitter account, step by step
To fix unusual activity on your Twitter account, log in, select Start, verify by phone, email or captcha, then change your password.
To fix the unusual activity message on your Twitter account, log in and follow the prompt X shows you.Select Start, then complete the check X offers: a phone code, an email code or a captcha.Change your password if the message says the account was locked for security purposes.Review the "Apps and sessions" section of your settings and revoke anything you don't recognize.
The walkthrough below covers each route in X's order, the choice you can't undo, and what to secure once you're back in.
How to fix the unusual activity message on Twitter
The Twitter unusual activity fix is a sequence X sets out itself. Twitter is now X, and the route is on its help page for locked and limited accounts.
When you log in or open your app, X says, you'll see a message with instructions.
Seven steps, in three phases.
Start the check
- Log in on the website or open the X app.
- Read the message and note its exact wording, because the wording tells you which route you're on.
- Select Start.
Complete the verification X offers
- Follow the route shown, which will be a phone code, an email code or a captcha check.
- Change your password if the message says the lock is for security purposes.
Secure the account afterwards
- Open the "Apps and sessions" section of your account settings and revoke apps you don't recognize.
- Update your password in the trusted applications that use it.
The first five steps remove the lock. The last two are what keep it from coming back.
The messages X documents for an unusual activity lock
X's help pages don't quote the sentence "we found some unusual activity on your account". The messages they do quote are these:
- "Your account has been locked"
- "Please verify your account"
- a message that the account "has been locked for security purposes"
The phrase "unusual activity" appears in X's documentation in one place. It describes what visitors to a locked profile may see: a message that the account has displayed unusual activity.
So if your screen uses slightly different words, don't worry about the match. Look for the Start option and the route it opens.
Verifying your X account by phone
This route begins with the "Your account has been locked" message. After you select Start, X asks you to enter your phone number.
The code comes by text message, or by a phone call. Enter it, then select Submit to unlock your account.
Two details are documented. X says it will associate that phone number with your account, and that the code may take a few minutes to arrive.
Give it those few minutes before you request another code.
Verifying your Twitter account by email
The email route uses the address already on your account. After Start, X's next screen offers Send email to begin the verification process.
X then sends an email containing a verification code. Enter the code and select Verify to unlock your account.
If the email doesn't appear, look further than the inbox. X suggests checking your spam, junk and social folders.
The captcha check on X runs in the background
The captcha route is for suspected automation. X says that if your account is locked because it detected suspicious automated behavior, you'll need to confirm you're the valid account owner.
Its description of the check is undramatic. You will see a pinwheel or wait cursor while the captcha check completes in the background, and you do not need to do anything.
Once X has confirmed you are not a robot, select Continue to X to unlock your account.
Phone, email and captcha are alternatives. X presents them as depending on the verification message you see, not as stages you pass through one after another.
Change your password when Twitter says the lock is for security
A security lock has its own fix. X says this message means it detected suspicious behavior, and that the account may have been compromised.
The documented route is a password change. X says the message carries instructions on how to restore access and secure your account by changing your password.
X also emails those instructions when an address is on the account.
For a security lock, the password change is the fix, and verification alone isn't the whole job.
X's advice is to use a new, strong password.
The limited-state choice on X that you can't undo
Sometimes the message offers a choice instead of a lock. For aggressive following or aggressive engagement, X gives two options:
- use X in a temporary, limited state for the specified time listed
- complete its instructions to verify your phone number or email address
Pick carefully. X says that if you choose the limited state, your account will remain limited for the specified time, and you won't see the option to restore your account by verification again.
If you would sooner verify, select Verify and follow the instructions. X says verifying a phone number and email address helps reduce potentially automated or scripted activity.
How to revoke apps in "Apps and sessions" on Twitter
Once you're in, look at what else has access. X's page on third-party apps and login sessions gives the steps:
- Sign in to your account.
- Go to the "Apps and sessions" section of your account settings.
- Select Revoke access next to the app, or at the bottom of the page after selecting the app's name.
X's security advice is to revoke access for any third-party application you don't recognize.
X does not say an app triggered your message. Treat this as the documented clean-up step, and not as proof of the cause.
Log out other sessions on your X account
The same section lists where your account is logged in. Under "Sessions", X says, you can see the location and time of each login.
Use "Log out" for a single session, or "Log out all other sessions" to keep only the one you're using.
After an unusual activity lock, the second option is the simpler choice. You will need to log in again on your own devices, which is a small price.
A password change doesn't sign out the X mobile apps
This catches people out after a fix. X says changing an account's password does not automatically log the account out of X for iOS or X for Android.
So a phone that was logged in stays logged in. If that phone isn't yours, a new password hasn't removed it.
X's answer is to revoke the app in your settings, which forces a new login. Pair the password change with the session check above and both gaps are covered.
X's five-step checklist once you regain access
X's page on compromised accounts lists what to do once you're in:
- Change your password.
- Make sure your email address is secure.
- Revoke connections to third-party applications.
- Update your password in your trusted third-party applications.
- Contact Support if you still require assistance.
The second step is easy to skip and matters most. Whoever controls the email inbox can reset the X password again.
Signs your Twitter account was compromised
X lists what a compromise looks like. Check your account for:
- posts you didn't write
- Direct Messages you didn't send
- follows, unfollows or blocks you didn't make
- a notification that your account information changed
- a password that stopped working
If none of these is present, the lock may have been a precaution. X adds that a third-party application can occasionally have a bug that causes unexpected behavior.
If any of them is present, work through the full checklist above, and delete the posts you didn't write.
An email change alert from X can be reversed
One message deserves quick action. X says that if you receive an email from verify@x.com regarding an email address change you didn't make, you can reverse it.
The route is in the email itself. X says the change can be undone by clicking on the provided link.
Do that first, before the other steps. Your email address is where every future code and reset link will go.
Does the unusual activity fix work better in a browser than the app?
X doesn't say so. Its instruction covers both: when you log in or open your app, you'll see a message with instructions.
No help page states a preference for desktop, and none mentions display problems with verification in the app.
Use whichever you have to hand. If one fails to load the prompt, trying the other is reasonable, but it isn't a documented requirement.
If you can't log in or can't receive the code on X
Every route starts with logging in. If you don't have login access, X says to contact its support team for additional help accessing and unlocking your account.
A lost phone number or email is harder. X says to contact support, and adds that sometimes the only option in this situation is to create a new account.
Don't look for a way around the prompt in the meantime. The support form is X's documented fallback.
The unusual activity fix on Twitter as a checklist
Run through it in this order:
- Log in and select Start.
- Complete the phone, email or captcha check you are shown.
- Change your password, and secure the email address on the account.
- Revoke unknown apps and log out other sessions.
- Update the password in the apps you trust.
Then add one protection for next time. X suggests you consider using two-factor authentication.
Begin with the login. The message on that screen decides everything that follows.
What to know after fixing an unusual activity lock
Do visitors still see a warning on your profile?
During the lock they may. X says visitors can see a message that the account has displayed unusual activity, and it doesn't state how soon that message goes after you unlock.
Was the unusual activity definitely a hack?
Not necessarily. X says a third-party application can sometimes have a bug that causes unexpected behavior, and that changing your password or revoking connections will stop it.
Should you scan your devices as well?
X recommends it. Its extra precautions include scanning for viruses and malware and installing security patches.
