How to Recover a Facebook Account in Malaysia

It is Sunday night and your Facebook app has logged you out. The password you have used for years no longer works. Then your sister sends a screenshot: your account is messaging relatives about an "urgent loan", and your inbox has an email from Facebook saying your email address was changed. You did not change it.

Most personal Facebook accounts in this position still have a route back, but only through Facebook's own tools, and the right tool depends on what actually happened. Hacked, locked, suspended and forgotten logins look alike from the login screen, but Facebook treats each one differently. This guide shows how to tell them apart, which official route matches each one, how Facebook's identity checks work, and how to lock the account down once you are back in. It covers personal profiles only; business Pages and ad accounts have their own guide.

Last checked: 28 September 2026.

#How Do You Recover a Facebook Account in Malaysia?

If you think someone else got into your account, go to facebook.com/hacked on a phone or computer you have used to log in to Facebook before, and follow the steps it shows. If Facebook emailed you about an email change you did not make, use the link in that email, sent to your old address, to reverse the change. If you only forgot your password and still have the email or phone on the account, use the normal password reset. If you have lost that email or phone, start at facebook.com/login/identify and choose "No longer have access to these?". If Facebook shows a suspension notice, log in and appeal within the time it gives you. Never share your password or login codes with anyone offering help. Only Facebook can restore the account, and it makes the final decision.

#Hacked, Locked, Suspended or Forgotten: Which One Is It?

Name the problem before you pick a route. A hacked account is one someone else has logged into without your permission. A locked account is one Facebook has paused because it saw unusual activity, and it asks you to confirm it is you. A suspended or disabled account is one Facebook has turned off for a Community Standards reason. A forgotten login is simply a password or contact detail you no longer have. More than one can be true: a hacked account can be suspended for what the attacker posted.

#Before You Start: Use a Device Facebook Already Recognises

Facebook repeats one piece of advice across its recovery pages: use a device you have logged in from before. That can be your usual phone, an old phone in a drawer, or a family laptop you once used. Meta said in December 2025 that its systems now recognise the device you usually use, and familiar locations, better than before. A brand-new phone on unfamiliar Wi-Fi gives Facebook less to go on.

#If Your Account Was Hacked, Start at facebook.com/hacked

facebook.com/hacked is Facebook's own tool for compromised accounts, and its help centre says you can use it even if you are not sure you were hacked. Facebook's hacked account guidance lists these warning signs:

• Your profile picture has changed.
• Posts, comments or messages you did not write.
• Login problems, or your two-factor method stops working.
• A Facebook alert about a login you did not make.
• An email saying an email address or phone number was added or removed, or your password was changed, and it was not you.
• An unfamiliar device or location under "Where you're logged in".

1. Open a device you have used for Facebook before, and type facebook.com/hacked into the browser yourself. Do not follow a link from a message.
2. Enter the email, phone number or name on the account when Facebook asks you to find it.
3. Follow each prompt. Facebook adjusts the steps to your situation, which may include confirming your identity.
4. Once you are back in, go straight to the security steps near the end of this guide.

If a relative is helping, the steps should still run on a device you, the owner, have used before, not on the helper's phone.

#If the Hacker Changed Your Email or Phone Number

Every reset now seems to go to the attacker, but there are two official routes. Try them in this order.

First, look for Facebook's email in your old inbox. Facebook says that when an account's email is changed, it sends the previous address a special link that reverses the change and secures the account. Before you click, check the sender. Facebook's page on checking whether an email is really from Facebook lists its sending domains, including facebook.com, facebookmail.com, fb.com, meta.com and metamail.com, and warns about misspelled lookalikes.

If that email is not there, use the account finder. Facebook's page for people who have lost access to the email or phone on the account suggests first trying facebook.com/hacked, then these steps:

1. Try every email and phone number you may have added over the years. For a Malaysian number, include the +60 country code.
2. On a familiar device, go to facebook.com/login/identify and search by email, phone, or your name or username.
3. Select "No longer have access to these?". Facebook says you may see "Forgotten account?" or "Recover" instead.
4. Give new contact details that have never been used on the account.
5. Complete the checks Facebook asks for to confirm the account is yours, then set a new password.

Recover your email account first if you can; Facebook itself suggests contacting your email provider. An attacker who controls that inbox can keep resetting Facebook behind you. Our guide to getting back in after losing your email, phone or 2FA walks through the email and SIM side, including a replacement SIM from your telco if your number was moved.

#If You Forgot Your Password but Still Have Your Email or Phone

This is the simplest case. Use "Forgot password?" on the login screen and follow the code Facebook sends. If the code does not arrive, Facebook's can't log in page suggests checking spam or junk, checking your signal, and waiting a few minutes before requesting another. If you did not forget the password and it simply stopped working, treat it as a hack and go to facebook.com/hacked instead.

#If Facebook Locked Your Account or Shows a Security Check

A locked account is a safety measure, not a punishment. Facebook's unlock page says it may lock an account when it sees unusual activity, and it tells you by email or with a message when you log in. To unlock it, open Facebook, select "Get started" and follow the on-screen steps, which may include confirming your identity.

If the confirmation code does not arrive, Facebook suggests checking spam and blocked messages, restarting the phone, asking your network provider whether your plan receives these texts, and waiting a day if you have already requested several codes.

After you complete a security check, Facebook may make you wait 24 hours before you can log in. Your profile stays visible to friends during that time. Facebook describes it as an extra security precaution.

#If Two-Factor Authentication Is Blocking You

Two-factor authentication (2FA) asks for a second proof, such as a code, when someone logs in from a device Facebook does not recognise. It is what keeps attackers out, and it can also keep you out after a phone change. Facebook's 2FA troubleshooting page suggests these, in order:

1. Wait a few minutes for a delayed SMS code, and check your signal and message storage.
2. Check Facebook on any other phone, tablet or browser where you are still logged in. You may be able to approve the new login there.
3. Enter one of your saved recovery codes. Each works once.
4. If none of that works, look for the help link on the code screen. On a computer it is "Need another way to authenticate?"; on Android it is "Having trouble?"; on iPhone it is "Need help?". Follow the identity confirmation steps.

Facebook notes that identity confirmation is not available in Facebook Lite. Use the full app or a web browser for that step.

#How Facebook Confirms Your Identity: ID Upload and Video Selfie

When Facebook cannot be sure you are the owner, it may ask for proof. At the time of writing, its Confirm Your Identity section covers two methods: uploading an ID and recording a video selfie.

ID upload. Facebook's accepted ID list takes one government ID, with examples including a national identity card, passport, driving licence or birth certificate. For most Malaysians that means a MyKad or passport. It must show your name with either your date of birth or a photo. Without a government ID, Facebook accepts two non-government documents that include your name, one of them showing your date of birth or photo. Facebook may reject an ID photo that is blurry, poorly lit, missing information, not fully in frame, or a photo of a screenshot or photocopy.

Video selfie. Meta said in December 2025 that it had added an optional selfie video to its recovery methods. Its facial recognition help page says that, if you agree to face matching, it compares your selfie or ID photo with your Facebook or Instagram profile photos, deletes the face data afterwards, and falls back to manual review or another method if there is no match. The option is not offered everywhere, so use it only if Facebook offers it. A profile with only cartoons or group shots may give the match little to work with, so a clear ID matters more.

Facebook says an ID you send is encrypted and never shown on your profile. Our ownership evidence checklist explains what else helps show an account is yours.

#Does Facebook Still Offer Trusted Contacts?

Not according to Facebook's own notice. Trusted contacts used to let friends you picked send you codes to get back in. Facebook's help centre now says trusted contacts is no longer supported, so those friends can no longer help you get back in, and advises keeping your email address and phone number up to date instead. Some older help pages, including the 2FA troubleshooting page at the time of writing, still mention trusted contacts; do not count on them.

If a friend's account messages you claiming you are their "trusted contact" and asks you to forward a code, stop. The code is almost certainly a login code for your own account.

#If Facebook Suspended or Disabled Your Account

A suspension is not a hack, and it needs an appeal rather than a recovery request. Facebook's suspended or disabled account page says it may suspend an account it believes does not follow its Community Standards. You will see "We suspended your account" when you log in, and an email.

• Log in, and Facebook will prompt you to appeal. The page gives 180 days, and also says the appeal period varies by region, so go by the date on your own screen.
• If you do not appeal in time, or the appeal fails, Facebook permanently disables the account and says you cannot request another review.
• Facebook may disable an account straight away, without a suspension first, for severe violations.
• Keep screenshots of the notice, your appeal and any reference details.

If you still have access, Account Status shows restrictions on your profile and on things you manage. At the time of writing you reach it through your profile picture, then "Help & support", then "Account Status".

If the suspension followed a hack, say so plainly in the appeal, with the dates you lost control and what the attacker posted. Facebook decides every appeal; nobody outside Meta can reverse it.

#Pages, Business Manager and Fake Profiles Have Separate Routes

Recovering your profile does not automatically bring back a business portfolio the attacker also took. If unknown admins appeared in your business portfolio or ads started running on your card, follow our guide to recovering a hacked Facebook Business Manager in Malaysia. For a Page you used to manage, see how we approach Facebook Page recovery. If the problem is a separate fake profile using your name and photos, that is impersonation, handled through reporting rather than recovery; our impersonation removal page explains that route.

#Recovery Scams: What Facebook Will Never Ask For

People who have just lost an account are prime targets for fake "Meta Support" pages and comments offering "instant recovery". Facebook says it will never ask for your password by email or send you a password as an attachment. Our guide to the fake Meta support scam in Malaysia shows how these messages are built.

If you already paid a scammer, or someone moved money out of your bank or e-wallet, call your bank's hotline or the National Scam Response Centre on 997 straight away, then make a police report. You can also report the phishing message to CyberSecurity Malaysia's Cyber999 service.

#Secure the Account Once You Are Back In

The attacker may still hold a session, an email or a phone number on the account. At the time of writing, most of these settings sit in Accounts Center under "Password and security" (profile picture, then "Settings and privacy", then "Settings"). Work through them in order:

1. Change the password to a long one you have never used anywhere else.
2. Open "Where you're logged in", choose "Select devices to log out", and log out every session you do not recognise.
3. Check Personal details and remove any email or phone number that is not yours.
4. Open "Recent emails" (facebook.com/recent_emails/security) to see which security emails Facebook really sent.
5. Turn on two-factor authentication. Facebook offers a security key, an authentication app or SMS codes; an app or key is harder to intercept than SMS.
6. Save your 10 recovery codes offline, and consider adding a passkey.
7. Run Security Checkup, which reviews your password, 2FA and login alerts.
8. Delete what the attacker posted, and tell friends and family the account is yours again.
9. Secure the email account behind Facebook with its own unique password and 2FA.

For a side-by-side of 2FA on Facebook, Instagram and TikTok, see our guide to setting up two-factor authentication.

#Your Facebook Recovery Checklist

• A phone or computer you have logged into Facebook from before.
• Every email address and phone number you may have added to the account.
• Your profile link or username (a friend can copy it from your profile).
• A new email address that has never been used on Facebook.
• Access to your old inbox, to look for Facebook's email-change message.
• Your MyKad or passport, for Facebook's own upload screen only.
• Dated screenshots of error messages, notices and anything the attacker posted.
• Your recovery codes, if you saved them.

#When Expert Recovery Help Makes Sense

Try the steps above first. Outside help may be worth considering when the attacker changed the email, phone and 2FA together, when identity checks keep failing, when a hack was followed by a suspension, or when you are not sure which route applies and do not want to waste an appeal.

SocialSafe by AwareXone is AwareXone's social media recovery service, run by a Malaysian team. We look at your situation before anything is agreed, and sometimes the honest answer is that Facebook's own tools are still your best route. Where we do take a case on, we help you choose the right official route, organise your evidence and prepare a clear, consistent request. The Facebook account recovery page explains how that works, and the recovery hub covers other platforms.

AwareXone is independent and not affiliated with Meta. We use the same official processes you can use, have no insider access, and cannot promise that any account will be restored. Facebook makes the final decision. You can read more about how we work. For steps that apply across Instagram, TikTok and other platforms, see our social media account recovery guide for Malaysia.

#Frequently Asked Questions