Akaun Kena Hack? What to Do First in Malaysia

Your friend messages you: "Eh, kenapa you minta pinjam duit?" You never sent that message. You try to log in to Facebook and the password no longer works, or WhatsApp suddenly asks you to verify your number again. You type "akaun kena hack apa perlu buat" into Google, which is how you got here.

Most takeovers can still be fought through official routes if you move in the right order. Secure your email and phone first, then use the platform's own hacked-account page, then warn your contacts and report any money lost. Every major app has a free recovery route, and none of them needs a stranger to hold your password.

This guide covers the first steps for every app, the official link for Facebook, Instagram, WhatsApp, TikTok and Google, the Malaysian agencies to call, and the scams that follow a hack.

Last checked: 29 September 2026.

#Akaun Kena Hack: What Should You Do First?

Start with the account that can reset all the others, which is usually your email, and change its password and sign out every other session. Then go to the platform's official recovery page, such as facebook.com/hacked or instagram.com/hacked, from a phone or computer you have used on that account before. Tell your contacts not to send money or codes to your account. If money has already left your bank or e-wallet, call the National Scam Response Centre on 997 and your bank straight away, then make a police report. The platform decides whether the account comes back, and nobody outside it can promise a result.

#Hacked, or Just Locked Out? Read the Signs

A hack means someone else controls or is using your account. A lockout means you cannot get in, but nobody else is inside. The difference matters, because a forgotten password needs a normal reset while a hack needs the platform's hacked-account route.

Facebook's page on recovering a hacked account lists the signs it looks for. They apply to most apps:

• Your profile picture, posts or messages changed and you did not do it.
• Your password or two-factor authentication suddenly stops working.
• You got an alert about a login, or an email saying your email, phone or password changed, and it was not you.
• Settings show a device or location you do not recognise.

If the account shows a notice saying it was disabled or suspended, that is the platform's own decision, and it needs an appeal rather than a hacked-account report.

#The First 15 Minutes, in Order

This is stressful, and the order matters more than speed.

1. Secure your email. Change the password, sign out of all other sessions, and remove any forwarding rules or filters you did not create. Google's Malay help page on a hacked Google Account tells Gmail users to check forwarding, filters and labels for exactly this reason.
2. Check your phone. If your SIM suddenly shows no service, call your mobile carrier from another phone and ask whether your number was moved to a new SIM. Login codes sent by SMS go wherever the number is.
3. Look for the platform's security email. Facebook and Instagram both send a message when the email on the account changes, with a link that can undo the change. Use that link only if it arrived in your own inbox.
4. Open the official recovery page for the app, using the table below.
5. Warn your contacts from another account, a phone call or a message on a different app. Ask them to ignore any request for money, codes or votes.
6. Screenshot the alerts, the changed details and any scam messages sent from your account, with the date and time visible.

#Which Official Link to Use for Each App

Every route below is free. If someone asks you to pay to use one, it is not the platform.

#Facebook Kena Hack: What Still Works

Facebook's help centre sends every hacked-account case to www.facebook.com/hacked, and it asks you to use a device you have logged in from before. Facebook recognises that phone or laptop, which helps it trust the request.

If the attacker changed your email, check your old inbox first. Facebook says that when an email is changed, it sends a message to the previous address with a special link that reverses the change and secures the account. Once you are back in, open "Where you're logged in" in your settings and log out any device you do not recognise. If you no longer have the email or phone on the account, the same help hub has a route for that case, and our guide to Facebook account recovery in Malaysia covers it step by step.

#Instagram Kena Hack: Login Links and Identity Checks

Instagram's page on a hacked profile starts with your inbox. If you got an email from [email protected] saying your email address was changed, select "secure my account" in that message to try to undo it.

If that fails, tap "Forgot password?" and ask for a login link to your email or phone. If you have lost both, Instagram lets you request support from a mobile device. It may ask for the email or phone you signed up with and the type of device you used then, or, for an account with photos of you, a video selfie turning your head. Instagram says that video is never shown on Instagram and is deleted within 30 days.

Instagram's announcement of instagram.com/hacked says the page lets you choose whether you were hacked, forgot your password, lost two-factor access or had the account disabled, then follow the steps for that case.

#WhatsApp Kena Hack: The Code Is the Key

Most WhatsApp takeovers in Malaysia start with a message asking you to forward a six-digit code, often from a friend's number that was itself taken. At the time of writing, WhatsApp's help page on recovering a compromised account describes this route:

1. Open WhatsApp on your own phone and tap "Log back in", then continue.
2. Enter your full phone number, with the +60 country code.
3. Enter the 6-digit code that WhatsApp sends to you by SMS or phone call. WhatsApp says this logs out every device that was using your account.

If WhatsApp then asks for a two-step verification PIN you never set, the attacker probably set it. WhatsApp says to wait 7 days and try again, and that the attacker is logged out once you enter the SMS code either way. It also says an account cannot be recovered without a SIM card holding the same number. Our guide to a stolen WhatsApp verification code covers the scam scripts in detail.

#TikTok and Google: Forms and Recovery Pages

On TikTok, try "Forgot password?" first. If the attacker changed the email or phone, TikTok's page on email and phone number problems says to tap "Need more help?" in the app and fill in a form that helps it verify your identity, and that the process may take up to 30 days. Answer with the details you really used on the account. Once you are back in, TikTok's privacy and security guide recommends turning on 2-step verification.

For Google, the same Malay help page sends you to the account recovery page if you cannot sign in, and asks you to answer its questions as well as you can. If you can still sign in, open "Semak peristiwa keselamatan" (Review security events) and choose "Tidak, bukan saya" (No, it wasn't me) for anything you did not do.

#Duit Hilang atau Kod Dikongsi? Where to Report in Malaysia

If money was lost, speed matters more than the account. The government's NSRC 997 page asks victims to call within 24 hours of finding out so banks can block transactions, and then to contact the bank and make a police report.

Cyber999 is CyberSecurity Malaysia's national point of contact for reporting computer security incidents. It takes reports by online form, by email to [email protected], by phone on 1-300-88-2999 during office hours, and through its mobile app. MCMC's complaint page is where hacking is mapped to PDRM. A report does not restore the account, but it creates a record. Our guide to reporting a hacked account in Malaysia walks through each channel.

#The Scams That Follow a Hack

A hack is often step one. Step two uses your name to reach people who trust you, or targets you while you are desperate to get back in. Watch for messages like these:

• "Sorry, saya tersalah hantar kod ke nombor you. Boleh forward balik?" This is how many WhatsApp takeovers start. The code is for your account.
• "Tolong undi anak saudara saya" with a voting link that asks for your phone number and code.
• "Urgent, boleh pinjam duit dulu? Esok bayar" sent from your taken account to your contacts.
• A "Meta Support" or "Page Violation" message warning that your account will be deleted unless you log in through a link.
• Comments and DMs from "recovery experts" or "hackers for hire" who promise to get the account back for a payment.

Our breakdown of the fake Meta support scam shows the fake warning pages in detail.

#Mistakes That Make Recovery Harder

• Recovering the social account before the email. The attacker simply resets it again.
• Reporting your own WhatsApp account before you try to recover it. WhatsApp warns this may get the account banned.
• Sending many recovery requests with different details. Use the details you really used on the account, once.
• Deleting the scam messages the attacker sent. They are evidence for the platform, the bank and the police.
• Opening a replacement account straight away and moving your followers. Warn people, but keep the old account's recovery going.
• Paying a stranger, or trying unofficial tools that claim to get into accounts. These can cost you money and your chance of an official recovery.

#Evidence to Keep Before You Start

• Screenshots of every security email and alert: changed email, new login, password change.
• Your username, profile link, the email and phone you signed up with, and the phone model you used then.
• Screenshots of scam messages sent from your account, and who received them.
• For a business account: invoices or ad receipts that name the account.
• A note of what you did and when, including any report numbers.

#When Expert Recovery Help Makes Sense

Many people recover a hacked account on their own with the steps above. Outside help is worth considering when the account supports your income, when a hack has turned into a disable, or when you have tried the official routes and heard nothing. SocialSafe by AwareXone, our recovery service, reviews what happened before anything is agreed, then tells you plainly which official routes are still open. We use the same platform processes described here and never ask for your password or codes. The recovery hub lists every platform we cover, and our Trust Center sets out how we work. Only the platform can restore an account, and some accounts do not come back.

#Frequently Asked Questions