Twitter account locked for suspicious activity: which notice you have and what it asks

The notice says suspicious activity and stops there. The trouble is that X, the platform formerly called Twitter, uses that idea for two different states, and the fix for one does nothing for the other.

A Twitter account locked for suspicious activity is in one of two documented states. Either X has locked it for security purposes because the account may be compromised, which is cleared by changing your password, or X has limited its features "due to suspicious activity" after aggressive following or engagement, which runs for a set time.

Below: how to tell the two apart, what each asks of you, and the behavior X counts as suspicious.

Two notices on X share the word suspicious

X's help page on locked and limited accounts quotes both notices, and they are easy to blur together.

The first says your account has been locked for security purposes. X explains that it has detected suspicious behavior, and that it appears your account may have been compromised.

The second reads: "Some of your account features are limited due to suspicious activity". X ties this one to aggressive following or aggressive engagements.

One is about who is using the account. The other is about how the account has been used.

Everything else in this article follows from that split.

What "locked for security purposes" means on Twitter

This notice means X suspects an intruder. It isn't saying you broke a rule.

X's wording is that it has detected suspicious behavior and that the account may have been compromised. The lock stops whoever is inside from doing more, and it holds until the owner secures the account.

The remedy fits the cause. When you log in or open your app, X shows a message with instructions on how to restore access and secure the account by changing your password.

A new password is the point, because it is the thing an intruder no longer has.

What "limited due to suspicious activity" means on X

This notice is a limit, not a lock. You can still get into X, with reduced features, for a period the message states.

X names the trigger. The limit follows aggressive following or aggressive engagements, and it lists the engagements as like, repost and quote.

X then describes what you will see: a message that your account's features have been limited for a specified time, which varies based on the nature of the violation.

People often call this being locked, which is understandable. In X's vocabulary it is a limited state, and it comes with a choice the security lock doesn't offer.

How to tell which Twitter notice you have

Read for three clues: the wording, the request and the button.

• Wording: "for security purposes" points to the lock; "features are limited" points to the limit.
• Request: the lock asks you to change your password; the limit asks you to wait or verify a phone number or email address.
• Button: the limit screen offers Continue to X or Verify.

If you are unsure which one you saw, log in again and read the message from its first line.

Check the email inbox tied to the account as well. X says it also sends instructions there when an account is locked.

How to fix a Twitter account locked for security purposes

A security lock is cleared from the message itself. The steps are short:

1. Log in on the website or open the app.
2. Read the message that says the account is locked for security purposes.
3. Follow the instructions to restore access.
4. Change your password when prompted.

If you can't log in to see that message, X's direction is different. Contact its support team for additional help accessing and unlocking the account.

Waiting does nothing for this state. There is no countdown on a security lock, so the account stays locked until the owner acts.

Your two options when X limits features for suspicious activity

The limit notice offers a choice. X describes both branches:

• Use X in a temporary, limited state for the specified time listed.
• Complete X's instructions to verify your phone number or email address.

To take the first branch, you select Continue to X, which starts the countdown. To take the second, you select Verify and follow the instructions X provides.

Neither option is the wrong one. Verifying is the quicker route back to full features, and waiting keeps your contact details as they are.

What matters is knowing that the choice is not fully reversible, which the next section explains.

Starting the countdown on X removes the verify option

Once you start the countdown, the other door closes. X says that if you choose the limited state, your account remains limited for the specified time and you won't see the option to restore it by verification again.

Decide before you tap. Many people select Continue to X because it looks like a way to dismiss the notice, and only later learn it was a choice.

If you intend to verify, pick Verify first.

If you have already started the countdown, the time in your notice is now the schedule. X documents no way to switch back.

What the limited state takes away on Twitter

The limited state is mostly about reach. X says that while the account is in it, your account and posts may be filtered out of certain places on X, including search results and notifications.

So you can open the app and read your timeline. What changes is how visible you are to people who don't already follow you.

That explains a frequent complaint during a limit: replies seem to go unnoticed and mentions don't land. They may not be appearing in other people's notifications.

Full visibility returns when the time ends or when you complete verification.

Repeat cases may lose phone verification on X

The verify option is not guaranteed. X says that repeat offenders may not be presented with the option to verify by phone.

In that case, its wording is plain: you will only be able to use X in a limited state for the specified time listed.

This is worth knowing before a second or third notice.

The first limit comes with an exit you control. Later ones may come with a clock and nothing else.

It is also the strongest reason to change the pattern that caused the first one.

How long does the suspicious activity limit last on Twitter?

X publishes no fixed length. The time is "specified" in your notice and, in X's words, varies based on the nature of the violation.

No table of hours or days exists on X's help pages for this limit. A figure quoted on a forum describes someone else's notice.

One thing is documented about timing. The countdown is initiated when you select Continue to X.

So if the notice has been sitting unanswered, the clock may not have started. Open it and make your choice.

Engagement that X treats as aggressive

Liking, reposting and quoting at high speed is the documented trigger for the limit. X's rules describe the surrounding behavior in more detail.

Its page on rules and best practices with account behaviors says that repeatedly posting duplicated and unsolicited replies to many accounts is considered spam behavior.

The authenticity policy covers the rest:

• repeatedly posting identical or nearly identical posts, which it calls "Copypasta"
• engaging with posts aggressively or through automation
• unauthorized automation, meaning scripted accounts that don't comply with X's Developer Policy

A real person can match the first two on a busy day. Replying with the same line to dozens of accounts is the classic example.

Following patterns behind a suspicious activity notice

Following is the other half of the trigger. X's authenticity policy names the patterns it acts on:

• follow churn, meaning following and then unfollowing large numbers of accounts
• indiscriminate following of unrelated accounts in a short time
• duplicating another account's followers, particularly using automation
• using or promoting third-party services that claim to add followers

X's page on following is blunter still. Automated proactive following and automated unfollowing are not allowed.

If a service has been following or unfollowing for you, that is the first thing to stop.

Is bulk following safe on X?

Only within X's limits and rules, and those are two separate tests.

X's page on following limits sets a technical cap of 400 follows per day, with ratio rules once you follow 5,000 accounts.

Speed has its own check. One documented error reads: "You've followed too many accounts too quickly. Try again in an hour or so."

Staying under the cap doesn't settle the matter. The rules on churn and indiscriminate following apply to the pattern, whatever the count.

There is a longer look at bulk following people on Twitter if this is how the notice found you.

The automation lock is a separate case on Twitter

There is a third notice that sits near these two. If an account appears to have shown automated behavior that violates the X Rules, X may lock it and ask you to pass a captcha challenge to confirm you are not a robot.

X describes that check as running in the background. It ends with a Continue to X button once X has confirmed you are not a robot.

This one is a true lock, cleared by verification, with no countdown.

It is listed here so you can rule it out. If your screen asked you to verify and never mentioned security or limited features, this is probably the one you had.

What X does not document about suspicious activity

Two common explanations have no source on X's pages. X does not say that logins from distant locations within a short time cause this notice.

It also does not describe the technology behind detection. Its words are "we detect" and "our systems", with no detail on models or signals.

Both may be true in practice. Neither is something X has published, so neither can tell you what happened on your account.

Stick to what the notice asks. The documented exits work whatever the underlying trigger was.

Checking whether your X account was really compromised

After a security lock, confirm what happened. X's page on compromised accounts lists signs such as posts you didn't write, messages you didn't send and follows you didn't make.

It then gives a cleanup order:

1. Change your password.
2. Make sure your email is secure.
3. Revoke connections to third-party applications you don't recognize.
4. Update the password in trusted third-party applications.
5. Contact Support if you still need help.

Do them in sequence. The second step is easy to skip, and an insecure inbox lets someone reset the password you just changed.

How severity changes what X does

The same behavior can lead to different outcomes. X's authenticity policy says consequences depend on the severity of the violation and on any previous history of violations.

For an isolated incident or first offense, X says it may take actions ranging from requiring deletion of one or more posts to temporarily locking the account.

For severe violations, accounts are permanently suspended at first detection.

Between those ends sit the options most people meet: anti-spam challenges, restricted reach and temporary loss of access to features.

A limit for suspicious activity is on the mild end of that range.

Objections to acting on a Twitter suspicious activity notice

"I did nothing wrong." You may be right. X says that if you feel the account was locked or limited in error, you can appeal by contacting its support team.

"I don't want to hand over a phone number." Then the limited state is the route X offers, and it ends by itself.

"I'll wait it out." That works for the limit and fails for the security lock, which has no timer.

"It will only happen again." Only if the cause stays. Revoke apps you don't use, and slow your following and engagement.

A Twitter account locked for suspicious activity has a documented exit in every case. Read the wording, pick the matching route, and take that one step today.

What to know about suspicious activity locks

Do I have to use the website to clear the notice on X?

No. X says the message appears when you log in or open your app, so either works. Use whichever one shows you the full notice.

Will X's captcha ask me to solve a puzzle?

It may. X's help page describes a captcha check that completes in the background while you wait, and its authenticity policy separately says accounts may be asked to solve a puzzle.

Does a suspicious activity notice mean a suspension is next?

Not by itself. X does warn that repeat violations of the X Rules may lead to permanent suspension, so the risk rises if the same behavior continues.