X has added liveness checks that can require suspected automated accounts to confirm a person is present using device biometrics or a selfie video. Its help documentation describes the checks as an anti-spam measure that can appear during signup or after unusual activity on a logged-in account.
Users only need to pass one available check. Options include Face ID or Touch ID on Apple devices, an enrolled biometric unlock method on Android, and a short selfie video. A camera-based hand-motion check is listed as coming soon.
The device-biometric route runs entirely on the phone or tablet through Apple or Android. X says it receives the pass-or-fail result and a device-integrity signal confirming that the request came from a genuine, unmodified X application, rather than receiving a face, fingerprint or iris scan.
That option is available only when a biometric has already been enrolled on the device. The supported check can vary by device, app version and region, and users can choose another available method if a particular option fails.
The selfie route records a short video with the front-facing camera. An automated system operated by a third party analyzes the video to distinguish a live person from a printed photograph, replayed video or mask. X says it receives a liveness confidence score, not the video itself.
The checks are intended to establish human presence rather than identify the individual. They cannot be started voluntarily, and X says accounts in good standing would not normally encounter them. Normal behavior can sometimes resemble automation and trigger a request. Reddit has also considered Face ID and Touch ID for human verification, with CEO Steve Huffman describing device biometrics as a lightweight option.
An account awaiting a successful check cannot perform write actions such as posting, following other accounts or sending direct messages. X says access to X Money remains available, and full account access is typically restored after the check is passed.
The verification must be completed through the official mobile app, rather than a web browser. Users prompted on x.com are directed to open the application on their phone. Some QR-code flows use an iOS App Clip, a temporary version of the app that does not require entering account credentials on the scanning phone.
X also warns that it will not send liveness-check links by email, text message or direct message. The checks appear inside the official app or the iOS App Clip, giving users a concrete way to distinguish a platform challenge from a phishing request. Cyble has identified phishing prompts disguised as identity-verification requests that trick users into granting browser camera and microphone access.
Sources: X, Social Media Today
–
By the ID Tech Editorial Team
