Elon Musk’s social platform X is dealing with user frustration after a back-end change to its multi-factor authentication system reportedly locked some people out of their accounts. According to a new report, X recently migrated its handling of hardware security keys to a different infrastructure, but did not communicate the change clearly or provide sufficient recovery options for affected users.
Users who had registered FIDO security keys for account protection began reporting that their keys no longer worked, and that they were unable to complete login even when they still had access to the registered devices. In some cases, users said they could not remove the non-functional security keys from their accounts or switch to a different second factor, effectively losing access to long-standing profiles.
The situation highlights the operational risks of large-scale changes to authentication infrastructure, especially for high-value accounts that rely on hardware keys as a defense against phishing and credential theft. For security leaders, the incident underlines the importance of robust migration planning, clear user communication, and well-tested recovery flows when modifying MFA or passkey implementations, particularly in consumer-facing platforms where account recovery often becomes the only line of defense once strong authentication is enforced.
The incident serves as a cautionary tale for organizations undertaking similar transitions, emphasizing that technical execution must be paired with comprehensive user education and fallback mechanisms to prevent permanent account lockouts.
Sources: TechCrunch
—
By Cass Kennedy
