X says it is investigating a wave of unsolicited password-reset emails believed to be connected to its expanded X Money rollout, with users reporting resets beginning on 1 September 2026. The company notes that, despite the timing around the broader X Money launch, there is no evidence of a breach or any account takeovers, and X has not confirmed a direct link between the reset activity and the Money service.
The rollout provides eligible US users with banking-like features, including a Visa debit card and peer‑to‑peer payments through banking infrastructure supplied by Cross River Bank. Analysts say the disruption could render some accounts more attractive targets, particularly those with payment access, large follower counts, or business use, but this remains speculative until further verification.
The report emphasises that requesting a password reset is not in itself proof of compromise; recovery workflows typically require access to the account’s associated email or phone number. The threat scenario described includes “reset flooding”—a tactic where attackers submit large volumes of reset requests to create noise, potentially enabling phishing or distracting users and security controls.
The advised consumer responses focus on not acting on unsolicited codes or links, enabling password-reset protections, and using two‑factor authentication via an authenticator app or security key. Users are warned to monitor for genuine signs of takeover and to stay alert for phishing that mirrors the reset process. Malwarebytes notes that a real-time protection solution can help detect fraudulent sites, and suggests using its Scam Guard as a check if uncertain about a message.