X liveness check: what triggers it and how to pass

#Quick answer

A liveness check is X asking the device in front of you to prove a live human is there. X sends one when its systems flag an account for unusual or automated-looking activity. Pass any one of three checks (device biometrics, a selfie video, or the hand motion check X lists as coming soon) and full access returns. Until you do, you keep reading but lose write actions: no posting, no following, no DMs. X says it never receives raw biometric data from any of them.

Last updated: October 2026

#What it is, and what it is not

X added liveness checks as the newest piece of its anti-bot machinery, with coverage dated 8 October 2026 (Social Media Today). X's own framing is narrow and worth quoting precisely: liveness checks are designed to confirm that a real person is present, not to identify who you are.

That distinction carries the whole page. X (formerly Twitter) already runs two other things people confuse with this one:

Age assurance uses facial age estimation or a government ID and commits to destroying the collected data within 31 days. Our X ID verification guide covers that process in full, and it is a different system with different data. A liveness check collects no identity at all.

#Why your account got flagged

This is the question people actually arrive with, and X answers it with unusual candour. If X's systems flag your account for unusual or automated-looking activity, you may get a check, and the help page states that this does not necessarily mean you did something wrong, because normal activity can sometimes resemble automation.

X defines automation as accounts or apps taking repeated actions without a person actively performing them (X Automation rules). Patterns that can look like that from the outside, whether or not a script is involved:

• Burst following or unfollowing. Fifty follows in ten minutes reads as a loop even when a human did it by hand.
• Near-identical replies at pace. The same template across many threads is the oldest spam signature there is.
• A brand-new account moving fast. Trust is partly a function of age, and a week-old account doing power-user volume stands out.
• Extensions and third-party tools acting on your session. Anything clicking on your behalf produces machine-shaped timing.
• A shared or unusual network path. Datacentre IPs and sudden geography jumps feed the same model.
• Sitting near X's rate ceilings. The published daily caps exist for a reason, and hugging them looks like what hugging them usually is. X daily limits has the current numbers for posts, follows and DMs.

None of that is an accusation. It is a description of what the detector sees, which is a different thing from what you did.

#The three ways to pass

X lists three check types, all carrying the same weight. You only need to pass one, and most take less than a few seconds.

1. Device biometrics. Face ID, Touch ID, or your Android device's biometric unlock. The scan happens entirely on your device, performed by Apple or Android, and X never receives your face, fingerprint or iris data. Only the pass or fail result is shared. This is the fastest option and the one that gives X the least.

2. Selfie video check. Your front-facing camera records a short video of your face. An automated system analyses it in real time to confirm it is seeing a live person rather than a printed photo, a replayed video or a mask. The analysis runs on a third-party system and X receives only a confidence score, never the video itself.

3. Hand motion check. X lists this as coming soon: wave a hand in front of the camera. Lower friction than a face recording, and useful for anyone who would rather not film themselves.

If a check fails or expires, you can retry it, or switch to a different type at any time. If you cannot complete any of them, X says to contact X Support and it will work with you to restore access another way. That path matters for anyone on an older device without biometric hardware, and how to contact X support covers which routes actually get a reply.

#What stops working until you pass

Here is the part the launch coverage skipped, and it is the practical consequence.

Until you complete the check, X states you will not be able to perform any write actions on the account: posting, following, sending a DM and so on. You retain access to X Money in that state. Reading continues to work.

So the shape of it is: your account is intact, your content is intact, and your ability to act is paused. That is a narrower restriction than a lock and far narrower than a suspension, and it resolves the moment you pass a check rather than through an appeals queue. If what you are actually looking at is a lock or a suspension rather than a liveness prompt, X account suspended covers the appeal path for those, and X's locked-and-limited help page documents how to appeal a limit applied in error.

One asymmetry worth planning around: the check appears in the official X app. If you live on x.com in a desktop browser and rarely open the app, a flagged account can look mysteriously broken, with posts failing for no visible reason, until you open the app and find the prompt waiting.

#The phishing surface this just created

Any new verification flow is a gift to phishers, and this one involves a camera.

X's position is unambiguous: a liveness check will only ever appear inside the official X app, and X will never send you a link to complete one by email, text message or DM. If you get such a link, it is likely a phishing attempt.

Apply that as a rule rather than a judgement call. No email, no SMS, no DM, no QR code, no "verify your account to avoid suspension" page, regardless of how good the branding is. Open the app yourself and look. If there is no prompt in the app, there is no check.

#If you automate anything on X, read this twice

For anyone running tools against their own account, liveness checks change the risk shape rather than the risk level.

What they are not: a visibility penalty. A liveness prompt is a gate on write actions, not reduced reach, and it is not the same thing as X limiting the visibility of specific posts. Conflating the two leads people to chase the wrong fix.

What they are: a human-presence test that arrives without warning and pauses everything until somebody taps a phone. That is a hard stop for any workflow that assumes an unattended account, and no amount of tuning makes a script able to wave a hand at a camera. X's automated account label is the sanctioned route for accounts that genuinely are bots, and declaring one does not exempt an account from a check.

The sensible read: an account that behaves like a person operated by a person, on a normal device and a normal network, is the one least likely to be asked. Volume and timing are what the detector sees, and they are also the two things most within your control. Automating engagement through a browser remains a gray area on X rather than a sanctioned path, and anyone doing it should expect occasional human-presence tests as a cost of the method rather than a bug in it.

#Bottom line

A liveness check is cheap to pass and easy to misread. It costs seconds, collects no identity, and does not touch your reach or your content. It does freeze posting, following and DMs until you clear it, and it only shows up inside the X app, which is the detail that turns a thirty-second task into a confusing afternoon for people who use X in a browser. Three options, any one works, retry freely, and treat every emailed version of it as fraud.

If you want the posting cadence of a daily user without the burst patterns that attract this kind of attention, X-Autopilot drafts posts and replies from a real Chrome browser on your own Mac, so the session cookie never leaves your machine and there is no delegate account or shared cloud IP pool: a lower detection surface than cloud tools, though it is a reduction in exposure rather than an exemption from X's checks. When a liveness prompt arrives, somebody still has to pick up the phone.