X Account Locked for Automation: How to Prove You Are Human
TL;DR
If X locked your account for "unusual" or automated behavior, first complete the in-app anti-spam challenge (add a phone number, solve a captcha). If the lock stays after 48 hours, file an appeal at help.x.com. When appeals fail, EU users can escalate under the Digital Services Act, and professional recovery services reach human reviewers directly.
What "Automated Behavior" Actually Means on X
X's Authenticity policy prohibits any activity that "manipulates the platform or disrupts services through inauthentic accounts, behaviors or content." In practice, the system flags you when your account looks like a script rather than a person: rapid-fire follows, bulk replies, near-identical posts, or third-party apps hitting the API in ways X didn't authorize.
The lock is not always a suspension. Most often it is what X calls an anti-spam challenge: your account is temporarily frozen, and you must prove you are human by adding a phone number, solving a puzzle, or verifying an email code. If you clear the challenge, access returns. If you cannot clear it, or if X escalates to a full suspension, you enter the appeal track.
Why X Flagged Your Account (The Real Triggers)
X does not publish its detection rules, but the pattern is consistent across support forums and the Authenticity policy itself. Accounts get locked for automated behavior when one or more of these signals fire:
- Following or unfollowing in bursts. "Follow churn" is called out by name in the policy. Following 200 people in an hour, then unfollowing them the next day, is a textbook trigger.
- Bulk replies or mentions. Sending the same reply to dozens of unrelated posts, or tagging strangers to promote something, hits the content spam rule.
- Third-party scheduling and engagement tools. Anything that logs into your account and clicks Like, Repost or Follow on a schedule is unauthorized automation unless it complies with X's Developer Policy. Most consumer "growth" tools do not.
- Copypasta posting. Repeatedly publishing identical or near-identical posts, especially with trending hashtags, is one of the fastest ways to a lock.
- Login from new devices or VPNs. A sudden IP change combined with high activity often trips the challenge, even without any policy violation.
- Mass reports from other users. Coordinated reporting can push an account into review even when no automation was involved.
Most users who receive an automation lock did nothing malicious. They installed a "grow your followers" app, ran a scheduler across multiple accounts, or simply engaged too fast during a viral moment. X's system does not distinguish intent, only patterns.
Step-by-Step: Pass the Anti-Spam Challenge
When you open X and see a message saying your account is locked or that "we've detected unusual activity," follow this order:
- Read the exact challenge type. X will ask for one of three things: a phone number, a captcha, or an emailed verification code. Do not close the screen. Reopening from a fresh session sometimes resets the flow.
- Add a valid phone number. Use a number that is not already on another X account (X allows one number to protect up to ten accounts, but reuse can fail the check). SMS verification is the most reliable path.
- Complete the captcha in the same session. If X presents an image puzzle, do not refresh or switch devices. Failing the captcha three times will escalate to a longer lock.
- Revoke suspicious connected apps immediately. Go to Settings → Security and account access → Apps and sessions → Connected apps. Remove anything you do not recognize or any "growth" tool. This alone often unlocks the account within hours as background scripts stop hitting the API.
- Change your password from a clean device. Use a device you have logged in from before, on a home network rather than a VPN. This lowers the risk score X assigns to your session.
- Wait 24 to 48 hours before posting again. The system watches for repeat behavior. Resuming automated patterns after a lock guarantees a second, longer suspension.
When the Lock Stays: Filing an Appeal
If the challenge does not release your account, or if X moved you straight to a full suspension notice, the next step is a formal appeal.
Go to help.x.com/en/forms/account-access/appeals. You will need:
- Your @handle and the email tied to the account
- A clear, one-paragraph explanation of what happened
- A statement that you have removed any third-party apps and stopped the flagged behavior
Keep the tone factual. Do not argue about whether the flag was justified. State what changed, why the behavior will not repeat, and request that access be restored. X's front-line reviewers process thousands of appeals per day and respond faster to short, specific requests.
Response time is typically 48 hours to 30 days. If you do not hear back within two weeks, you can file a second appeal referencing the first case number. Repeated identical submissions without new information can trigger auto-rejection.
What to Do If Your Appeal Is Denied
A denial is not the end. Denied appeals on X can still be reversed through three channels:
- Digital Services Act complaint. If you live in the EU or Czechia, X is a designated Very Large Online Platform under the Digital Services Act. Article 20 requires X to provide an effective internal complaint-handling system for at least six months after any decision to suspend or restrict an account. If X's appeal process failed you, you can escalate to a certified out-of-court dispute settlement body under Article 21.
- GDPR data access request. Under Article 15 of the GDPR, you can request all data X holds on your account, including the reasoning behind any automated moderation decision. This often reveals whether the lock was triggered by a specific policy or by a generic risk score, which strengthens a follow-up appeal.
- Professional recovery. Services that handle account restoration as a legal matter, rather than a support ticket, can reach the internal review teams that regular users cannot. This is the fastest path when time-sensitive assets, such as a verified account, monetized following, or business communications, are at stake.
How Recover Handles Automation Lockouts
Recover is a professional account recovery service operated by Solverae s.r.o. in Prague. Instead of resubmitting the same appeal form, Recover's legal team frames each case under applicable law (GDPR, DSA, and X's own Terms of Service) and reaches real human reviewers inside the platforms.
The relevant numbers for X automation locks:
- 97% success rate across all supported platforms
- 96% of cases resolved within 30 days, some within 10 days
- Full money-back guarantee if recovery fails
- No account password required
Pricing is one-time: €290 for a personal profile, €690 for a business profile, and €990 for a large-reach profile (24,000+ followers). Recover also offers a Pay After Recovery option: a €19 verification deposit up front, with the full fee (plus a 30% premium) charged only if your account is restored.
For cases older than 80 days, recovery chances drop and Recover provides a reduced 50% refund guarantee.
Prevention: Staying Off the Automation Radar
Once you get your account back, the priority is not repeating the pattern. A second lock for the same behavior almost always leads to a permanent suspension.
- Disconnect every third-party engagement tool. This includes follower analyzers that require write permissions, auto-DM apps, and any "growth" service. Read-only analytics tools are usually safe.
- Cap your own activity. Fewer than 400 follows per day, no bulk unfollows, and no more than a handful of near-identical posts per week.
- Use one X account per identity. The policy permits up to 10 accounts for genuinely different purposes, but running duplicate content across multiple accounts is grounds for suspension of all of them.
- Turn on two-factor authentication. A protected account is less likely to be hijacked, which is another common cause of "automated behavior" flags after the fact.
If you also handle other platforms, similar principles apply. Our guides on X 2FA lockout recovery and X account suspension appeals cover adjacent problems.
Frequently Asked Questions
How long does X keep my account locked for automation?
Anti-spam challenges typically resolve within minutes once you add a phone number or solve the captcha. If X escalates to a full lock, it usually lasts 12 hours to 7 days. Locks that remain longer than a week almost always require a formal appeal.
Will I lose my followers if my account is unlocked?
No. When an anti-spam challenge is cleared or an appeal succeeds, your followers, posts, and DMs remain intact. Followers are only removed if X separately decides they were fake or coordinated, which is a different process.
Can I be locked for using a scheduling tool like Buffer or Hootsuite?
Only if the tool falls outside X's Developer Policy. Approved posting schedulers that use the official API are generally safe. Tools that log in with your password and click Like or Follow on your behalf are unauthorized automation and can trigger a lock.