Here’s a timely question from the mailbag:
People on Twitter are reporting getting DMs from me with links that I didn’t send. I don’t know what to do. Sometimes, being on Twitter in the first place feels like a stretch — and now I feel like I need to wear some kind of sign saying Beware – I spread evil phishing crap. Help!
First of all: Big hugs for the worry and the shame. I’m so sorry the evil phishing crap slimed you. You don’t deserve that at all, and it’s completely not your fault. Not! Fair!
Next, here’s a 3-step plan to give you in-the-hard reassurance and info.
Three things to do immediately if you even slightly suspect that your Twitter account has been hacked
- Change your Twitter password (on the Twitter site itself, by really truly logging into your account). This will solve the vast majority of problems.
- Follow Twitter’s instructions to revoke connections to third-party services that may have obtained access to your password.
- Follow @spam and @safety, which are official Twitter accounts for phishing updates and info.
You can change your password again if you have any doubts at all about the timing or legitimacy of where you made the password change. There’s no downside to changing your password multiple times.
If you really want to (and it’s OK if not — if this is too much like wearing a scarlet letter) you can tweet a regular public tweet that says in a friendly way “hey everyone, please ignore any DMs that appear to be from me but contain a strange link. The phish-monster got me and I’ve fixed it now.”
And you can respond individually, if you want to and it feels right, to people who say they got such a message from you.
But don’t feel like you have to do that.
How did someone get into my Twitter account?
What happened to you is fairly common. I’m trying for reassurance-mode here, not meaning to diminish the reality or the pain of realizing someone is using your account for nefarious purposes.
It happens when someone or some outside service gets ahold of your Twitter password. Not through Twitter itself, but through some third-party service that asks you for it for what seems like a legitimate reason. There are certainly legitimate reasons to give your Twitter password to another service — for instance, if you use a Twitter client like Tweetdeck, or you have linked your Facebook and Twitter accounts. The evil hackers usually pose as a legitimate service or invent some reason you need to give out your Twitter password.
So if you change your password with Twitter and then don’t enter it anywhere else, their access to your account is cut off.
I get these DMs-with-weird-links from friends sometimes (I got one this morning, actually. Not from you!). And I usually DM them back to warn them that they should change their password — trying again for supportiveness and helpfulness and reassurance, which can be hard to get across in 140 characters!
But I never blame them or think they’re evil. I blame the evil phishers for being mean to my nice friends. And I think most experienced Twitter users feel the same way. We know it’s not your fault, and we know you’re not an evil phisher.



