-
A scam account disguised as “X Enforcement” is sending fake rule violation alerts to X users.
-
The account is linked to a hijacked verified profile that shows zero followers and zero following.
-
Victims are pushed to click an outside link within 24 hours or risk losing their account.
Scammers are finding new ways to trick people on X, even careful ones. A fake account calling itself “X Enforcement” is now messaging users directly.
It claims their posts broke platform rules. The account borrows X’s official look to seem real. No click or download is needed for the trick to start working.
How the scam account operates
X user @0xSweep first spotted the scam and warned others about it. He told followers not to click any link sent by the fake account. According to his post, the “X Enforcement” account is tied to a verified brand profile. That profile has zero followers, which is unusual for a supposedly official page.
Screenshots shared in @0xSweep’s warning show the verified account actually belongs to Brandt Electrical. That company handles electrical work, air conditioning, and roofing in Katy, Texas. The profile carries a blue checkmark and lists an official website. Yet it shows zero followers and zero accounts followed, a strange gap for a real business page.
The scammers appear to have taken over or copied this verified identity. They then used its badge and blue-check status to look trustworthy. A checkmark alone does not prove an account is safe or run by X, a point X itself makes in its guidance on fake emails and phishing.
Inside the fake violation message
One message shared by @0xSweep tells the recipient that a recent post broke X’s platform rules. It claims the post’s reach has already been cut. Engagement on that post is also supposedly limited now.
The message then warns that this restriction might stay in place. It adds that the user’s whole account could be affected if nothing is done. This wording is built to worry the reader into acting fast.
To push urgency further, the message asks the user to visit an outside website. It tells them to explain their side within 24 hours. Instead of pointing to an X web address, the link leads to reviewmedia-x.com.
That mismatched domain is one of the biggest red flags in this scam. A short deadline, a claimed rule break, and a threat to the account all follow a pattern seen in past scams, a tactic Bitdefender has documented in earlier campaigns targeting X users.
Staying safe from the scam
Several other X users say they got the same message. A user named MaxtonLiop reported being contacted too and said he blocked the account right away. Another user, @mike6tn, thanked @0xSweep for the warning and said he would avoid the link entirely. Some users also asked why a verified business account with almost no activity would be sending enforcement notices.
So far, no major cybersecurity outlet appears to have reported this exact campaign on its own. The main source remains @0xSweep’s original post, along with the screenshots and replies from other users responding to it.
Similar high-pressure tactics have shown up before, as SentinelOne notes in its coverage of earlier phishing campaigns aimed at X accounts, and as Phishing Tackle has also reported on similar scams targeting the platform.
X’s own safety pages warn about fake messages claiming to be from the platform. They explain how to check whether a message is genuinely from X. Anyone who gets a similar “X Enforcement” message should avoid clicking the link inside it.
The concerns over user safety on X have also drawn attention from privacy advocates. In July 2026, 15 privacy and consumer protection groups, including the Electronic Frontier Foundation, the Electronic Privacy Information Center, and the National Consumers League, urged the FTC to reject X’s bid to end ongoing privacy oversight.
Instead, they should open the official X app or website on their own and check their notifications and account settings directly. That is the only way to confirm whether a real enforcement action was taken.
This scam shows how attackers combine familiar branding, tight deadlines, and threats of account loss to appear convincing. When an unexpected enforcement notice shows up, checking it through the platform itself remains safer than trusting any link inside the message.
