Password reset requests that are not solicited by X users have been on the rise since August, and this has worried users. This is due to the very nature of reset requests through email: once a malicious actor gains access to the reset, they can claim the account as theirs—and thus hijack one’s account. It is similar to the ‘Forgot Password’ feature employed by services like Google, Meta, and other services. They all require emails, and the key distinction is that the actors do have access to emails stemming from data leaks. This is a hole in security, and X management is currently investigating an internal investigation into the issue.
X is a social media platform that allows for instant posting of the latest sentiments of anyone, and any community. Its importance cannot be understated: it holds almost 11 percent market share in the social media platform space, just behind Facebook and its contemporaries. More than 50 percent of its user base accesses the platform for news. And there are tens of millions of influencers, users, and news outlets—not discounting the countless communities themselves that shape the opinion of the people.
Circling back to the issue of password reset requests through email, it is believed by industry experts that this is aimed at accessing not just the account itself, but the “X money” payment feature. And once this feature is exploited, more sensitive information such as addresses, credit card information, and identification may be stolen. Thus, the issue goes beyond the account: it leads to a cascading effect of data breach after data breach, ultimately compromising—to a great degree—the individual exploited.
A brief background of X money is warranted to convey the gravity of the situation. X money is a feature within the platform that allows users to deposit funds with up to 6% interest, pay bills, and transfer money between accounts and users. This requires a linking of financial information: bank information, credit cards, or the like; and this is a necessity for any financial service. X aims to be a financially integrated social media platform with this initiative (and other initiatives like X crypto); but it, again, exposes security risks.
Currently, users are advised not to click on the emails but instead use the in-app verification feature.
