Shouldn't updates go to "social", and 2fa - to inbox?