--
title: "Phishing DMs That Pretend to Be X Support: Seven Signals and What to Do"
description: "These messages do not attack your technical setup, they attack your sequence. Follow the steps once and the account is gone. Seven signals you can check one by one, why the messages look credible, and the order to work in after you clicked."
tags: ["security", "twitter", "phishing", "privacy"]
canonical_url: https://digital-footprint-health.shop/blog/x-phishing-dm-scams
Phishing DMs pretending to be platform support have one thing in common. They do not attack your technical setup. They attack your sequence.
Follow the steps once and the account is gone. Read it that way and the judgement gets much easier, because you no longer have to decide how convincing a page looks. You only have to decide whether the official channel would ever ask for this in this way.
Official verification flows live in settings or the notification centre, where you go and look. They do not arrive as a message asking you to act. That single fact resolves most of these on its own.
1. They attack the sequence rather than the setup
They attack the sequence, not the setup, and that makes them easier to spot
The framing that makes these easy to handle: you never have to judge how convincing the page looks. You only have to judge whether the official channel would ever ask for this in this way. Verification flows live in settings or the notification centre, where you go and look. They do not arrive as a message asking you to act, and that single fact resolves most of these.
2. Seven signals, and any two together are enough
Seven signals, and any two together are reason to stop
The seven signals are worth keeping as a checklist rather than a memory: a DM asking you to verify, a deadline, a domain that is not the real one, a request for a password or a code, a handle with an added digit, a profile with almost no history, and a push to continue on another app. Any single one is thin. Two together are reason to stop, and when the domain and the code request land in the same message the case is closed.
3. Three stacked factors explain why the messages look credible
Three stacked factors explain why the messages look credible
The credibility comes from stacking, not from craft. The handle and avatar can be made near identical, which costs nothing. The copy cites features that really exist, verification badges, copyright appeals, unusual login alerts, so it sounds reasonable. Time pressure then supplies a short deadline. The combined effect is that people skip verification and go straight to solving the problem, and that state is what gets exploited.
4. After a click: five steps, and the order carries the weight
After a click: five steps, and the order matters more than the list
Treat a click as a live exposure even if you closed the tab immediately, because some pages try to read session data as they load. Order matters more than the individual actions: change the password from a different device, sign out unrecognised sessions, revoke connected apps, confirm two factor is tied to something you physically hold, then check the email and phone on the profile, since those get changed first.
5. A fixed sequence outlives a memorised signal list
A fixed sequence beats a memorised list, because the signals keep changing
The signals keep changing and a fixed process does not. Three rules cover most cases: never complete a verification that arrives through an external link, never hand over a code to anyone, and when a message applies a deadline put it down for an hour before touching it. None of those require judging authenticity. They only require keeping your order intact.
Practical takeaways
- They attack the sequence
- Seven signals
- Three stacked factors explain why the messages look credible
- After a click: five steps
- A fixed sequence beats a memorised list
None of those three rules require you to judge authenticity. They only require keeping your order intact, which is a much easier thing to do reliably at the end of a long day.
The longer version with the reference detail is here: https://digital-footprint-health.shop/blog/x-phishing-dm-scams
