X (Twitter) scams
Last updated September 18, 2026
The short answer
On X, the reliable rule is that complaining publicly to a company attracts fake support accounts within minutes. Paid verification means a blue check no longer indicates identity, so a verified account replying with a "support" link is frequently the scam.
X changed what its own trust signal means. When verification indicated identity, an impersonation had to work around the absence of a check; now that verification can be bought, a scam account can carry exactly the same mark as the brand it is imitating. Combined with the platform's role as a public complaints desk — where people post account problems and tag companies — that produces a steady supply of targets and a removed defence.
How X (Twitter) scams work
- 1
Fake support replies
You complain publicly about a company. Accounts with similar handles and verification badges reply offering help and direct you to a "support portal" or ask you to DM credentials.
- 2
Crypto giveaway replies
Under a real post from a company or a public figure, replies from lookalike accounts announce a giveaway: send crypto, receive double. Deepfaked video is increasingly used.
- 3
Verification and copyright phishing
Messages warning that your account will lose verification or has a copyright strike, linking to a fake login page. Account takeover follows, and the account is used to run the same scam against its followers.
- 4
Investment DMs
Unsolicited DMs offering trading signals or portfolio management, leading to the same fake platform used in romance scams.
Warning signs
- A "support" account replies to your public complaint offering help
- The handle is subtly different — an underscore, a doubled letter, an extra word
- A verified account promotes a crypto giveaway
- You are told your verification or account is at risk unless you act now
- A DM offers investment returns or trading signals
- A login page is not on x.com or twitter.com
- Anyone asks for a verification code
Examples
The support account that replied first
A user tags an exchange about a stuck withdrawal. Within two minutes a verified account with a near-identical handle replies offering help and links to a support portal. The portal asks for the seed phrase to "validate the wallet". The wallet is emptied before the real support team has seen the original post.
The deepfaked giveaway
A reply under a genuine company announcement shows a video of its chief executive announcing a doubling giveaway, with an address on screen. The video is a conference recording with synthesised audio and lip sync. The address receives dozens of payments and returns nothing.
What to do
- Contact companies through their own app or website, never through a reply or a DM.
- Check the handle character by character, not the badge.
- Never send crypto to receive crypto. No giveaway has ever worked that way.
- Never share a seed phrase, password or verification code.
- Turn on two-factor authentication with an app or key, not SMS.
- Report impersonation accounts — X removes them, though slowly.
Report it to X (Twitter)
Report impersonation and scam accounts through help.x.com. Verification is a paid feature and is not evidence of identity.
Getting your money back
Crypto sent to a giveaway address is gone; file at ic3.gov with the transaction hashes anyway, since destination addresses at regulated exchanges are occasionally frozen. If credentials were given up, change the password, revoke sessions and connected apps, and check whether the account has been posting — a taken-over account is used immediately to run the same scam against its followers, so warning them matters. Turn on two-factor with an authenticator app or security key rather than SMS.
Frequently asked questions
Does a blue check mean an account is genuine?
No. Verification on X is a paid subscription feature, not an identity check. Scam accounts buy it routinely, which is precisely why it works as a prop. Verify by the handle and by whether the account is linked from the company's own website.
Why do fake support accounts reply so quickly?
Because they monitor mentions of company handles automatically and reply within seconds, usually before the real support team has seen the post. Public complaints are effectively an advertisement that you have an urgent account problem.
Are crypto giveaways on X ever real?
Not the kind that require you to send crypto first. That format is always a scam, including when it appears under a real company post, on a verified account, or in a convincing video of a named executive. Deepfaked announcements are now standard production values for it.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about X (Twitter), these are the guides worth reading next.