Security / Privacy
X Money Made Old Accounts More Interesting to Attackers
After X Money launched, users reported waves of unsolicited password-reset emails. X said it was investigating and had not found evidence of a platform breach.
#Security #Account Takeover #X #Social Media #Phishing
Money changes the value of an account.
After X Money became widely available, X users reported receiving unsolicited password-reset emails. TechCrunch reported that X said attackers appeared to be mass-triggering password-reset requests using public usernames. At the time of that report, X said it had not found evidence of a breach or mass account takeovers.
That distinction matters.
A flood of reset emails can be an attack attempt without being proof that the attacker succeeded.
What it means for users
Once a social account can also touch payments, identity, or financial services, the cost of losing that account goes up.
Turn on the strongest authentication the service offers. Do not approve login prompts you did not initiate. Do not follow password-reset links from messages when you can instead open the app or site directly.
And make sure your email account is protected at least as strongly as the social account itself. If somebody controls your email, they may control the recovery path for everything attached to it.