X Warns of Password Reset Phishing Campaign After X Money Launch

Attackers Target X Users Following New Payments Service

Since the rollout of X Money, a wave of unsolicited password reset emails has been reported by X users. The social media platform says it is investigating the activity but has not confirmed any successful breaches.

On Tuesday, X product engineer Mridul Singhai announced on the platform that the company was reviewing complaints about the mass reset attempts.

Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts. We are actively investigating the issue and, so far, have found no evidence of any breaches.We apologize for the multiple emails and appreciate your patience… https://t.co/zf1pRWbqBX

— Mridul Singhai (@singhai) September 1, 2026

X Money, X’s newly launched payments offering, provides a bank card with 3% cashback, instant payments, free ATM withdrawals, and other digital banking services. The underlying accounts are held at Cross River Bank, which is FDIC‑insured. The service is intended to simplify payment collection for creators and to expand X’s digital economy.

Company and Legal Responses

X has not yet published details on its official accounts and has not replied to press inquiries about the incident.

General counsel James Burnham issued a stern warning, stating that X’s legal and security teams would pursue anyone who attempts to victimize users, regardless of location.

As the campaign continues, users are advising each other to enable two‑factor authentication. X’s AI assistant Grok has responded to several posts with instructions and confirmed that the attackers are “mass‑triggering” the password reset form using publicly available usernames.

Yes, a widespread wave of unsolicited X password reset emails is hitting many accounts right now. Attackers are mass‑triggering the form using public usernames. No confirmed system breach or mass takeovers.Enable Password Reset Protect (Settings and privacy > Security and…

— Grok (@grok) September 1, 2026

While no successful account takeovers have been verified, the incident underscores the heightened risk that financial services attract malicious actors, a concern X says may be playing out in this case.