# Hacked Instagram or Facebook in Australia: Do I Report to ReportCyber or IDCARE First? > Instagram or Facebook hacked in Australia? Whether to report to ReportCyber or IDCARE first, what each does, and how to recover your account. - URL: https://www.awarexone.com/research/australia-hacked-reportcyber-or-idcare - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-29 - Topics: Instagram, Facebook, Australia, Hacked accounts - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer In Australia, recover the account through Meta's hacked flows first, then report to ReportCyber (cyber.gov.au) if a crime occurred, such as money loss or blackmail. Contact IDCARE, a free identity support service, if your personal details may be misused. The Telecommunications Industry Ombudsman points people to IDCARE for help with digital platforms. ## Summary - Recover the account through Meta first. - ReportCyber records cybercrime. - IDCARE helps with identity misuse, free. - Call your bank if money was lost. - eSafety handles some online harms. Here's the right order in Australia. Last checked: 29 October 2026 against the sources listed at the end of this guide. ## Where do I report? | Need | Go to | | --- | --- | | Recover account | Meta hacked flows | | Money lost or blackmail | ReportCyber and bank | | Identity details exposed | IDCARE | | Image abuse or bullying | eSafety | > Warning: **One wrong step can cost you the account.** One wrong step can cost you the account, so know what you are doing before you start. If you are not sure, do not submit an appeal yet. Ask AwareXone for a free expert review first, then act. Each service does a different job, and none of them replaces the others. Meta is the only party that can give you back control of an Instagram or Facebook account. ReportCyber, run by the Australian Signals Directorate's Australian Cyber Security Centre, records cybercrime and incidents so they can be assessed and passed to police. IDCARE is a not-for-profit identity and cyber support service that helps you work out what personal information is at risk and builds a response plan with you. Your bank is the only one that can stop or chase a payment. The order matters because the first hour after a takeover is when the attacker is most active. They often change the email, phone number and password, turn on their own two-factor authentication, and then message your followers with fake investment offers or requests for verification codes. Every minute you spend filling in a police form before securing the account is time they can use to lock you out further. ## What should I do first? 1. Recover the account. 2. Call your bank if needed. 3. Report to ReportCyber. 4. Contact IDCARE about identity risks. Related guides: [Instagram or Facebook Hacked in the UK: Should I Report It to Report Fraud?](https://www.awarexone.com/research/uk-instagram-facebook-hacked-report-fraud), [Social Media Account Hacked in the UAE: Where Do I Report It to the Police?](https://www.awarexone.com/research/uae-social-media-hacked-report-ecrime-aman), [Instagram or Facebook Hacked in Singapore: Where Do I Report It and Who Can Help Me Recover?](https://www.awarexone.com/research/singapore-instagram-facebook-hacked-report). ## How do I recover the account through Meta? For Instagram, check your email for a message from security@mail.instagram.com saying your email address was changed. Instagram says you may be able to undo the change by selecting the secure my account option in that message. If that does not work, tap Forgot password on the login screen and request a login link to your email or phone. If you no longer control either, follow the on-screen steps to request support, where Instagram may ask for a video selfie of you turning your head if the account has photos of you. Instagram says that video is never shown on the account and is deleted within 30 days. For Facebook, use the Recover a hacked account flow in the Facebook Help Centre from a device and network you have used before. Facebook asks you to secure the account, review recent changes to your email, phone and password, and log out sessions you do not recognise. Once you are back in, turn on two-factor authentication with an authenticator app rather than SMS where you can. ## What should I put in a ReportCyber report? - The account name and the profile link. - The date and time you lost access, in Australian time. - Every email or text you received from Meta about changes to the account, with screenshots. - Any messages the attacker sent to you or your followers, including payment requests or threats. - Bank or card transaction details if money was taken, plus the reference number your bank gave you. - What you have already done, such as the Meta recovery request and the date you submitted it. Keep the ReportCyber reference number. Your bank, your employer or IDCARE may ask for it, and it helps if the same attacker targets other people. ReportCyber will not unlock your account or contact Meta for you, so do not wait on it before you finish the recovery steps. ## When should I contact IDCARE? Contact IDCARE when the attacker may have seen or used personal information beyond the social media account itself. Common examples are a copy of your driver licence or passport stored in your messages, your date of birth and address on the profile, or reused passwords that also open your email or online banking. IDCARE can help you work out which documents and accounts to protect next. eSafety also notes that IDCARE can help people recover from scams, identity theft and other cybercrimes. If someone is threatening to share intimate images or is using your account to bully someone, report that to eSafety as well. eSafety has powers for image-based abuse and cyberbullying that the other services do not have. ## What common mistakes should I avoid? - Reporting but not recovering. - Skipping the bank call. - Ignoring identity risks. - Paying 'recovery' services that promise results. The most common avoidable loss we see is a person who reports the crime, waits for a reply, and only tries Meta's recovery flow days later, after the attacker has removed every recovery option. The second is paying someone who contacts you after you post about the hack. Real recovery never starts with a stranger asking for your login code, a fee in cryptocurrency, or remote access to your phone. ## How do I keep the account safe while I sort this out? - Never share a login code, password or backup code with anyone, including people who say they work for Meta, the police or a recovery service. - Make sure the email address and phone number on the account are ones you still control, and remove any you do not recognise. - Turn on two-factor authentication where the platform offers it, ideally with an authenticator app, and keep your backup codes somewhere offline. - Log in only from the official app or by typing the address yourself, not from links in messages, comments or ads. - Keep screenshots of every notice, email and step you take, with dates, in case you need them for a review or a report. - Make one careful attempt at each official step rather than many rushed ones, because repeated failed attempts can trigger extra checks. ## When It Is Safer to Get Expert Help Ask for help before you appeal if the account matters to your income, your business or your memories, if you have already had one appeal rejected, or if you cannot tell whether the problem is a bug, a restriction or a hack. That is where most avoidable losses happen. AwareXone has solved 1,300+ cases and works only through official platform processes. Support is available 24 hours, every day. We never ask for your password, login codes or backup codes, and we never name our clients. [Request a free case review](https://www.awarexone.com/contact?interest=account-recovery-case) or [message us on WhatsApp](https://wa.me/601137634679). Malaysian cases are priced in MYR; other markets are quoted in USD after review. AwareXone is independent and not affiliated with Meta, Instagram, Facebook, WhatsApp or Threads. Recovery work is best-effort and the platform makes the final decision. - The attacker has already changed the email, phone number and two-factor settings, so the login link goes to them. - The account runs a business, takes bookings or has ads with a saved payment method. - Meta has disabled the account because the attacker posted content that breaks the rules. - You have already submitted a video selfie or appeal that was rejected. ### Is IDCARE free? Yes. IDCARE is a not-for-profit identity and cyber support service, and its support for individuals in Australia is free. It does not recover social media accounts, but it helps you plan what to protect after a breach. ### Will ReportCyber recover my account? No. ReportCyber records the crime and can pass it to police, but only Meta can restore access to an Instagram or Facebook account. Start Meta's recovery flow first, then report. ### Which first? Secure or recover the account through Meta, and call your bank straight away if money was taken. Then report to ReportCyber and contact IDCARE if identity documents or details were exposed. ### Can you help? Yes. AwareXone offers a free case review. We look at what you see on screen and what you have tried, then tell you the safest next step through Meta's official routes. ### Should I report to the police if no money was lost? You can still report through ReportCyber if your account was taken over, because it is unauthorised access to your account. Reporting helps build a picture of the attacker even when you have not lost money. ### Can AwareXone check my case before I appeal? Yes. AwareXone offers a free case review. Send us what you see on screen and what you have already tried, and an expert will tell you whether to appeal, wait or take another route. We never ask for your password or codes. ## Official sources - [Official: Submit a Report (Australian Signals Directorate's ACSC) (read 29 October 2026)](https://www.cyber.gov.au/report-and-recover/report) - [Official: IDCARE Official Website (read 29 October 2026)](https://www.idcare.org/) - [Official: Digital platforms - TIO (read 29 October 2026)](https://www.tio.com.au/common-issues/digital-platforms) - [Official: If you think your Instagram profile has been hacked (read 29 October 2026)](https://help.instagram.com/149494825257596) - [Official: Recover a hacked account (read 29 October 2026)](https://www.facebook.com/help/1216349518398524) - [Official: Social media 'ban' or delay FAQs (eSafety Commissioner) (read 29 October 2026)](https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions/faqs) - [Official: Report Fraud service goes live (read 29 October 2026)](https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.