Twitter unusual activity: why X shows this message on an account

A warning about unusual activity appears, and nothing you did seems to explain it. On X, the platform formerly called Twitter, that phrase has a specific home, and it always sits on top of a lock or a limit.

A Twitter unusual activity message means X has detected behavior on the account that looks compromised, automated or against its rules, and has restricted the account until its owner verifies. X uses the exact phrase for the notice that profile visitors see, while the owner sees wording about suspicious behavior or suspicious activity.

Below: where the message appears, the causes X documents, the ones it does not, and how the owner clears it.

Where the unusual activity wording appears on X

X uses the phrase in two documented places, and both face outward.

Its page on notices on X says a notice is added to an account "if we detect unusual activity from it".

The second place is the profile itself. X says visitors may see a message letting them know the account has displayed unusual activity, and asking them to confirm they still want to view it.

So the wording is often seen by someone other than the owner. A friend opens your profile, gets the interstitial and tells you about it.

That is useful to know. If people mention this message, your account is in a restricted state, and the owner-side prompt is waiting for you at login.

What the account owner sees on Twitter instead

The owner gets different words for the same event. X's help page on locked and limited accounts quotes three versions:

• Security lock: the account "has been locked for security purposes", because X detected suspicious behavior and thinks it may be compromised.
• Automation lock: X detected "suspicious automated behavior" that violates its rules, and you need to confirm you are the valid owner.
• Limited features: "Some of your account features are limited due to suspicious activity".

Each wording leads to a different exit. The first asks for a new password, the second for verification, and the third offers a timed limit or verification.

Reading which one you have is the first real step.

Why does Twitter say there is unusual activity on my account?

Because X detected one of three things:

• The account looks like someone else may be using it.
• It looks automated.
• It has been following and engaging at a pace X calls aggressive.

X describes all three on its page about locked and limited accounts. It does not publish the thresholds behind any of them.

That gap is why the message feels vague. You are told the category and the way out, not the precise action.

The sections that follow take each documented cause in turn, then the popular explanations X never mentions.

Cause one: X thinks the account may be compromised

A security lock means X suspects an intruder. Its page on compromised accounts lists the signs to look for:

• unexpected posts by your account
• Direct Messages you did not intend to send
• follows, unfollows or blocks you didn't make or approve
• a notification that your account information changed
• a password that no longer works

If any of these fit, the unusual activity was real, and it wasn't yours.

X adds a calmer note on the same page. Unexpected updates don't always mean a break-in, because a third-party application can occasionally have a bug that causes unexpected behavior.

How Twitter accounts get compromised

X names four routes:

• a malicious third-party application or website you entrusted with your username and password
• a weak password
• viruses or malware on your computer
• a compromised network

The first route is the one people overlook. X warns against giving credentials to sites claiming to help you "get more followers fast!"

A weak password is the easiest to fix. X's guidance is at least 10 characters, and unique to X.

None of this is about blame. It tells you where to look once you are back in.

Cause two: behavior on X that looks automated

An automation lock follows activity that resembles a script. X says that when it detects suspicious automated behavior that violates its rules, you will need to confirm you are the valid account owner.

X's automation rules draw the line clearly. Scripting the X website, a non-API form of automation, may result in permanent suspension.

A person can still trip this without a bot. Very fast, very repetitive actions look the same to a detection system whether a human or a program made them.

If you have never used an automation service, look at connected apps next. One of them may be acting for you.

Cause three: aggressive following and engagement on Twitter

The limited version of the message is tied to pace. X says features are limited for suspicious activity after aggressive following or aggressive engagements, and it names the engagements: like, repost and quote.

This is the one cause that doesn't lock you out. You can still open X, with features limited for a time shown in the message.

It often follows an ordinary burst. Someone follows a long list of accounts after a conference, or likes every reply in a busy thread.

Slow down first. If the pattern continues after the limit ends, X's rules allow stronger action.

Sending DMs in bursts on X

Mass messaging is documented as a violation. X's authenticity policy lists sending bulk, aggressive, high-volume unsolicited replies, mentions or Direct Messages, and it separately names sending identical Direct Messages.

There is also a plain cap of 500 messages sent per day.

The two are different. The cap is a technical ceiling that returns an error when you reach it.

The policy is about the pattern, so a few dozen identical messages to strangers can matter more than a high count of real conversations.

If you sent the same invitation or link to many people shortly before the message appeared, that is a likely trigger.

Connected apps and the unusual activity message on Twitter

Apps with access can act in ways you never see. X's stated position is that you are ultimately responsible for third-party applications you authorize to access or use your account.

X documents the risk in general terms. It mentions malicious apps, apps you have given your password to, and apps that automate in ways its rules forbid.

It does not single out any category, such as schedulers or follower trackers, and it does not use a label like "unverified app".

One practical test comes from X's own security advice. A legitimate app doesn't need your username and password. X warns that handing those over lets someone lock you out or take actions that get the account suspended.

Why X asks for a password reset after a third-party app

X may reset a password itself. When an account appears to be hacked or phished, it says it may proactively reset the password to revoke the hacker's access, then email the owner instructions.

A third-party application is one way credentials leak, which is why the two events often arrive together.

After the reset, X's cleanup order includes a step people skip. Update the new password in any trusted application that uses it. An app that keeps trying the old one produces failed logins.

There is more on Twitter asking for a password reset after a third-party app if that is the prompt you received.

Someone else trying to log in is a different state on Twitter

Failed sign-in attempts by a stranger do not produce the unusual activity lock. They produce a temporary lockout.

X documents it separately. After a limited number of failed attempts to sign in, you are temporarily locked out from trying, and X says the lock lasts about an hour and then clears on its own.

The difference is easy to spot. The lockout stops sign-in for a while and asks nothing of you. The unusual activity states ask you to verify, change a password or wait out a limit.

If waiting an hour fixed it, you had the lockout.

What X does not list as a cause

Several popular explanations are missing from X's pages. No X help page names a VPN, a proxy or rapid switching between devices as a reason for this message.

People report the message after those events. That is an observation, and it may be right in some cases, but it isn't X's documentation.

What X does document for a new device is a login alert. It is sent after a suspicious login or a first login from a new device, by push notification or email.

An alert informs you. It does not restrict the account.

How the owner clears the message on X

Clearing it means completing the prompt X shows at login. X documents these routes:

• a verification code sent by text message
• a phone call that delivers the code
• a code sent by email
• a captcha check that runs in the background

For a security lock, the instructions also have you change your password.

For limited features, X offers a choice between verifying a phone number or email address and using X in a limited state for the time listed.

Whichever route appears, it is the documented one. There is no separate setting that removes the message.

What to check in your Twitter settings afterward

Once you are in, review what has access. X's page on third-party apps and login sessions points to the Apps and sessions section of account settings.

Two checks matter there:

1. Review connected apps and use the Revoke access button next to any you don't recognize or no longer use.
2. Review Sessions, where X shows each active login with its location and time.

Sessions has two buttons, Log out and Log out all other sessions. If a login looks unfamiliar, the second one ends everything except the device in your hand.

This step is what stops the message from returning for the same reason.

Emails from X about account changes

An email can be the first sign of unusual activity. When the address on an account is changed, X sends an alert to the previous address.

If you did not make the change, that message matters. X says a mail from verify@x.com about an email change can be reversed through the link it contains.

Secure the inbox as well. X's cleanup order puts "make sure your email is secure" second, right after changing the password, because whoever controls the inbox can reset the account.

When the message is still there after a reset

If a password reset and the prompts don't restore the account, X's last step is its support team.

X asks for two details. Submit the request from the email address associated with the account, and include both your username and the date you last had access.

Those details let support match you to the account, so have them ready before you start the form.

X doesn't publish a response time. Keep the confirmation email, and avoid filing duplicates while you wait.

Twitter unusual activity, in short

The phrase is X's label for a restricted account, shown mainly to visitors.

Behind it sits one of three documented causes: suspected compromise, automated behavior, or aggressive following and engagement.

The owner clears it by completing the prompt at login, and by changing the password when the lock is for security.

VPNs, proxies and device switching are not on X's list. A stranger's failed logins lead to a one-hour lockout, which is a separate state.

Your next step is the simplest one. Log in, read the exact wording, and follow that prompt before changing anything else.

A Twitter unusual activity notice ends where the owner's verification begins.

Unusual activity FAQ

Can I still open a profile that shows the unusual activity notice?

Yes. X says visitors are asked to confirm they still want to view the account, so the notice is a checkpoint and the profile opens after you confirm.

Does a login alert from X mean there is unusual activity?

Not by itself. X sends login alerts after a suspicious login or a first login from a new device, and only for logins through X for iOS and Android, X.com and mobile web.

Will X ask for my password in a message?

No. X says it never asks for your password by email, Direct Message or reply, so treat any such request as an attempt to take the account.