Please read first. This article explains how to recover a hacked account and how a written request works. The case we describe comes from a client in Japan, and we have changed the details so that no one can be identified. Many requests do not succeed, and when they don’t, X often sends only template replies or nothing at all. Nothing here guarantees a result. We are a Gyoseishoshi office in Japan, not attorneys or solicitors.
You are logged out of X (Twitter). Your password no longer works. When you try to reset it, the code goes to an email address you have never seen. Someone has taken over your account and changed the email on it. You contact support, attach screenshots and explain everything, and the reply says that X couldn’t verify that you are the owner, so it can’t help further, and suggests you create a new account.
This article explains why that reply often doesn’t fit a hacked account, what X’s own Help Center asks you to send, and what you can do when support keeps sending the same template.
A hacked account is not a suspension
A suspension is X’s decision that you broke its rules, and you challenge it through an appeal. A hacked (compromised) account is different: someone else got in without your permission. What you need is not an appeal but help to regain access. X’s Authenticity policy itself lists unauthorized access to another person’s account as something it does not allow.
What X’s Help Center asks for
X’s help page for compromised accounts says that if you still can’t log in after trying a password reset, you should submit a support request, and that you should include your username and the date you last had access to the account. Before you write to support, gather:
- your username
- the email address and phone number you had registered before the takeover
- the date you last had access
- screenshots of the password reset screen, showing the unfamiliar (masked) email address
- every case number from support’s replies
Check your inbox for warning signs
Go back through the inbox of the email address you used to have on the account. In hacked-account cases we have seen, the warnings were often there weeks or months before the takeover: password change notices the owner did not make, password reset codes they did not ask for, and login alerts from new devices or places they had not been. These messages are evidence. Don’t delete them; take screenshots that show the date and time.
Why the template reply often doesn’t fit
The reply that says X can’t verify you as the owner usually tells you to contact your email provider or phone carrier if you can no longer use the registered email or number. That advice is written for someone who has lost access to their own email. In a takeover, your email often still works perfectly. What changed is the email on the X account, and someone else changed it.
When the same template arrives again and again, regardless of what you attach, it may be that your request is being handled automatically rather than read by a person. And “create a new account” does not solve a takeover: the person who took your account keeps using it, and can post or send messages to your followers in your name.
What a written request can add
When support requests keep failing, a letter to the company sets out the whole story in one place. X’s terms name X Corp. in the United States as the provider for US users, and X Internet Unlimited Company in Ireland for users in the UK. The points we normally organize are:
- A dated timeline of the takeover, built from the warning emails: when the password was changed, when reset codes and new-device logins appeared, and when you were locked out.
- Why the template reply doesn’t fit: you still control your original email, so the advice to contact your provider does not apply.
- That you gave what the Help Center asks for: your username, your original email and the date you last had access.
- That you will verify your identity in whatever way X needs, such as answering questions only the real owner would know or providing ID.
- Why a new account is not a solution, since the hijacker keeps control of yours.
- Every reference number from previous support replies, so X can match the case.
- What you are asking for: a review by a person, and for the account’s email to be returned to an address you control so that you can reset the password.
A case from our office in Japan
A client in Japan was logged out of their personal X account one day and found that the registered email had been changed. They sent several requests to support, and most came back with the same template saying ownership couldn’t be verified. Looking back through their inbox, they found password change notices, reset codes and new-device login alerts going back months.
We prepared a request setting out the timeline and the points above. It was sent to X’s Japanese company in Japanese (a step available to clients in Japan) and, in English, mailed inside the United States by USPS Certified Mail to X Corp.
Around the time the US letter was delivered, the hijacker began posting from the account, and the client submitted a new report through the Help Center. About a week later, X sent a password reset email, and the client got the account back.
This is one case, and we cannot know what part the letter played. We chose this case because it ended in reinstatement; it is not a typical result. Other cases take longer, and many requests lead to no change.
Beware of recovery scams
People who post about a hacked account are often contacted by strangers offering to get it back for a fee. They may ask for your login details or for payment up front. Don’t share passwords or codes, and be wary of anyone who promises recovery.
Once you get your account back
- change your password to a new one you have never used before
- check that the email address and phone number are yours again
- review logged-in devices and connected apps, log out of any you don’t recognize and remove access
- turn on two-factor authentication, and the option that requires your email or phone number to reset the password
- check what was posted or sent while the account was out of your control; take screenshots first, then delete anything harmful
- secure the email account too: change its password, turn on two-step verification and check it has no forwarding rules you didn’t set
- change the password on any other service where you used the same one
What to expect
- No one can guarantee recovery. X decides, and no letter can force it to act.
- Results and timing differ. In our X cases, when there is a response it has come anywhere from a few weeks to about three months after delivery, and many cases see no change.
- Most of our cases so far have been for clients in Japan. We can’t give you odds for an account in the United States or the United Kingdom.
Frequently asked questions
Support says it can’t verify I’m the owner. Is that the end?
Not necessarily. Keep your evidence, check that each request gives your username, original email and the date you last had access, and avoid sending the same message over and over. A written request to the company is another option. None of these guarantees recovery.
Should I just make a new account, as support suggests?
You can, but it doesn’t solve the takeover. The other person keeps your account and can use your name. If you open a new account, tell your followers that the old one was hacked.
Should I report the hack to the police?
Getting into someone else’s account without permission can be a crime. If the hijacker is using your account to deceive people or there is financial harm, consider reporting it. In the United States, that can be the FBI’s Internet Crime Complaint Center (IC3) or the FTC at ReportFraud.ftc.gov. In the UK, you can report it to the police or the national fraud and cyber crime reporting service.
Are you lawyers?
No. We are a Gyoseishoshi office in Japan, a licensed legal profession in Japan that is separate from attorneys. We prepare and send documents. We do not give legal advice on US or UK law, negotiate with X for you or represent you in court.
Sources: X Help Center, Help with my compromised account and Authenticity policy (April 2025); X Terms of Service. Links checked November 2026.