--- title: I fell for a phishing attack and lost access to my X... description: A developer with 20 years on Twitter/X shares a personal account of falling for a sophisticated phishing attack that resulted in losing access to their... canonical: https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I fell for a phishing attack and lost access to my X account. Here are five mistakes I did that you need to avoid! | daily.dev og:description: A developer with 20 years on Twitter/X shares a personal account of falling for a sophisticated phishing attack that resulted in losing access to their... og:url: https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx og:image: https://api.daily.dev/og/posts/cFsXn3pdx.png og:image:alt: I fell for a phishing attack and lost access to my X account. Here are five mistakes I did that you need to avoid! og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I fell for a phishing attack and lost access to my X account. Here are five mistakes I did that you need to avoid! **[Christian Heilmann](https://daily.dev/sources/christianheilmann)** · 8 min read · 7 upvotes · 2 comments ## Summary A developer with 20 years on Twitter/X shares a personal account of falling for a sophisticated phishing attack that resulted in losing access to their account. The post details five key mistakes: acting in a rush during a security task, not scrutinizing a convincing phishing email, failing to check the sender address or link URL, ignoring the browser autofill not triggering on the fake login form, and not having an authenticator app set up. The attacker quickly changed the account email and locked the victim out. Practical takeaways include always verifying sender and URL, treating missing autofill as a red flag, and using an authenticator app rather than SMS-based 2FA. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@fabianletsch** · 0 upvotes > Wow that was an impressive attack! > > > I would argue one more thing that too many people get wrong: > > > Stop using the same damn password for everything!!!!! **@stuartgreig** · 0 upvotes > What would of saved you is having two factor setup in the first place. I don't understand why these sites don't force you to enable it ## Similar posts on daily.dev - [I fell for a phishing mail and lost access to Twitter/X ?](https://daily.dev/posts/i-fell-for-a-phishing-mail-and-lost-access-to-twitter-x--sghyafznr) · Christian Heilmann · 1 upvotes · 1 comments - [New X phishing scam copies real login alerts down to the pixel to hijack accounts](https://daily.dev/posts/new-x-phishing-scam-copies-real-login-alerts-down-to-the-pixel-to-hijack-accounts-t40pio7ve) · The Next Web · 0 upvotes · 0 comments - [Kurt Got Got](https://daily.dev/posts/kurt-got-got-zhrtqb70a) · Fly.io · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"I fell for a phishing attack and lost access to my X account. Here are five mistakes I did that you need to avoid!","url":"https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx"},"datePublished":"2026-02-22T11:58:15.370Z","dateModified":"2026-02-22T11:58:36.331Z","description":"A developer with 20 years on Twitter/X shares a personal account of falling for a sophisticated phishing attack that resulted in losing access to their...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bfeca44a0497adfb2c95735a04d68643?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bfeca44a0497adfb2c95735a04d68643?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Christian Heilmann","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Christian Heilmann","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b7a6a6c548b947f88970e64c05ad125b","url":"https://daily.dev/sources/christianheilmann"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"security,authentication,phishing","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Christian Heilmann","item":"https://daily.dev/sources/christianheilmann"},{"@type":"ListItem","position":3,"name":"I fell for a phishing attack and lost access to my X account. Here are five mistakes I did that you need to avoid!"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/i-fell-for-a-phishing-attack-and-lost-access-to-my-x-account-here-are-five-mistakes-i-did-that-you--cfsxn3pdx","comment":[{"@type":"Comment","text":"Wow that was an impressive attack!\nI would argue one more thing that too many people get wrong:\nStop using the same damn password for everything!!!","datePublished":"2026-02-25T11:01:11.965Z","url":"https://daily.dev/posts/cFsXn3pdx#c-SrZJGQuui","author":{"@type":"Person","name":"Fabian Letsch","url":"https://daily.dev/fabianletsch","image":"https://lh3.googleusercontent.com/a/ACg8ocKR6BVy_wn23EoOKq7-BlszlcXcLmASlnb7l-GtS-q1bePnkaJf=s96-c"}},{"@type":"Comment","text":"What would of saved you is having two factor setup in the first place. I don’t understand why these sites don’t force you to enable it","datePublished":"2026-03-06T18:36:29.469Z","url":"https://daily.dev/posts/cFsXn3pdx#c-3VxxAGX0Z","author":{"@type":"Person","name":"Stuart Greig","url":"https://daily.dev/stuartgreig","image":"https://media.daily.dev/image/upload/s--FoVqUWgr--/f_auto/v1772633885/avatars/avatar_V6TOuZS8XXplYvc5hNLgE?_a=BAMAMiiu0"}}]} ```