An unexpected email change can leave you unsure who controls your X account. Begin by checking whether you can still sign in and whether your original email account remains secure. Those two observations give you a useful starting point without guessing how the compromise happened.
If you can still sign in
X recommends changing the password, securing the linked email address and revoking unfamiliar third-party applications. Review these separately: changing a password should not be treated as proof that every connection has been removed.
X also says its email-change notification can contain a link to reverse the change. Verify the message before using it, and access support through the official website if you are uncertain.
If you cannot sign in
Try the official password-reset route. If that does not restore access, X’s compromised-account guidance directs owners to its support request. It asks for the username and date you last had access, using the email associated with the compromised account.
Prepare a short chronology rather than a theory about the attacker. Keep the following information together:
- Your username and profile URL.
- When you last controlled the account, with a time zone.
- Which email or phone contact you can still access.
- Notifications of changes you did not make.
- Earlier support references and the response received.
Keep recovery and enforcement questions separate
If the account also displays a suspension notice, record it as a separate issue. Reclaiming access and reviewing an enforcement decision are different tasks; describe both accurately instead of assuming one action resolves everything.
For a business account, appoint one owner to coordinate the request. An authorized agency can organize the chronology without receiving passwords or login codes. After access returns, review unfamiliar activity and connected applications before resuming publishing.
Frequently asked questions
Does an email change mean the account is unrecoverable?
The change alone does not establish that. Retained access, available contact methods and the official recovery process determine the options you can try.
What should I send for an assessment?
Start with the public username, the changes you observed and any support reference. Keep credentials and unnecessary private documents out of the initial message.