# Fake Hacker Offering to Recover Your Account? It Is a Scam

> A hacker in your DMs offering to recover your hacked account in Malaysia is running a scam. How it plays out, the red flags, and what to do if you paid.

- URL: https://www.awarexone.com/research/fake-hackers-offering-account-recovery-scam
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026-10-05
- Topics: Scams, Account recovery, Malaysia
- Related service: Account security: https://www.awarexone.com/services/account-security

## Short answer

A stranger offering to hack your account back is a scammer. No outsider can break into a platform's systems or pull strings inside Meta, TikTok or Google. They take an upfront fee, invent more fees, and often ask for your login codes. Use the platform's own recovery route, and if you paid, call your bank or 997.

## Summary

- A stranger who calls themselves a hacker, cyber expert or Meta rep and offers to recover your account is running a scam.
- Nobody outside the platform can break back into an account or pull strings inside Meta, TikTok or Google, so the fee buys nothing.
- These people often ask for your login codes, which hands them whatever access you still had, and then ask for one fee after another.
- Use only the official recovery routes, such as instagram.com/hacked or the platform's help centre, and never share a password or code.
- If you paid, call your bank or the NSRC on 997 straight away and make a police report, keeping every chat and receipt.
- Even honest help is best effort: the platform makes the final decision and some accounts do not come back.

Your Instagram or Facebook was hacked, so you posted about it. Within minutes the comments fill up: "DM this ethical hacker, he got my account back in 2 hours." Then a message arrives from a "cyber expert" or a "Meta rep" who says they can recover the account today, for a fee, if you move the chat to Telegram or WhatsApp.

The short answer: it is a scam. Nobody outside the platform can break back into your account or pull a lever inside Meta, TikTok or Google. These offers take your money, and often your last bit of access too. The real routes are free and run by the platform itself. And no honest helper, AwareXone included, ever asks for your password, login codes or backup codes.

This guide shows how the recovery hacker scam plays out step by step, the red flags, what legitimate help looks like, and what to do in Malaysia if you have already paid or shared a code.

Last checked: 5 October 2026.

## Can a Hacker Really Recover Your Hacked Account?

No. A person who contacts you offering to hack your account back cannot do it, and the offer is the scam. Platforms decide who controls an account through their own checks, such as login links, security codes and identity reviews. Meta's [phone support page](https://www.meta.com/help/policies/23938634512490588/) says it does not have a general public phone number for customer service and that numbers claiming to be Meta support are potentially scams. Google says on its [account recovery page](https://support.google.com/accounts/answer/7682439?hl=en) that it does not work with any service that claims to provide account or password support. Close the chat, block the sender, and use the platform's official recovery route instead.

## How the Recovery Hacker Scam Plays Out, Step by Step

The details change, but the pattern is steady. Knowing the order helps, because each stage is designed to make the next payment feel reasonable.

1. The bait. You post publicly that you were hacked, or comment on a post about hacked accounts. Fake accounts reply with praise for a "hacker" and a username to contact.
2. The approach. A message arrives from someone calling themselves an ethical hacker, cyber expert, recovery specialist or a "Meta rep". The profile often shows screenshots of "recovered" accounts and thank-you messages that cannot be checked.
3. The move. They ask you to continue on Telegram or WhatsApp, away from the platform where you could report them.
4. The first fee. They ask for an upfront payment, usually by bank transfer to a personal account, an e-wallet or cryptocurrency, and promise a quick result.
5. The codes. They ask for your username, then a code that has just arrived by SMS or email. That code is often a login or password reset code for the account you still control, such as your email or WhatsApp.
6. The extra fees. Something always goes wrong: a "server fee", a "tool licence", a "release fee" or a payment to "clear the flag". Each one is the last, until the next.
7. The exit. When you stop paying, they block you. Some threaten to post your private data or report you. Others come back pretending to be a second hacker who can "recover" your money from the first.

Malaysian police have described the same shape in money recovery scams. In April 2026, Bukit Aman's Commercial Crime Investigation Department warned of syndicates that advertised fund recovery services on Facebook, moved victims to WhatsApp, asked for an upfront payment, then told victims to make several payments to different bank accounts and kept demanding more, [as reported by Bernama via Malay Mail](https://www.malaymail.com/news/malaysia/2026/04/13/pay-more-lose-more-police-warn-of-double-scam-trapping-victims-with-fake-recovery-offers/216147). The account recovery version works the same way, with a hacked profile as the hook instead of lost money.

## What the Messages Say and What Is Really Happening

The lines below are typical of what people report, paraphrased rather than quoted from any one chat. Scammers write in English, Bahasa Malaysia and Chinese, and switch to whichever you reply in.

*Common recovery hacker lines, what they mean and the safe response. Wording varies by scammer and language.*

| What they say | What is really happening | What to do |
| --- | --- | --- |
| "I am a certified ethical hacker. I recover Instagram, Facebook and TikTok accounts." | Real ethical hackers test systems with written permission from the system's owner. They do not cold-message strangers offering to break into platforms. | Do not reply. Block and report the account on the platform. |
| "I work with the Meta recovery team" or "I have a contact inside TikTok." | There is no private desk you can buy access to. Meta points people to its help centres, and Meta Verified subscribers to their own support. | Use the official help centre for your platform. |
| "Send me the code you just received so I can verify you." | The code is a key to one of your accounts. Sharing it can hand over your email, WhatsApp or the hacked account's last recovery option. | Never share any code, with anyone. |
| "Pay half now, half when the account is back." | The first half is the whole point. The second half never comes up because nothing is done. | Do not pay. Keep the chat as evidence. |
| "The server needs one more payment to finish." | A made-up fee to extract more money. There is no server. | Stop paying and report the payment to your bank. |
| "I can get back the money the last hacker took." | A second round of the same scam, aimed at people already scammed once. | Ignore it. Report the original loss to your bank, 997 and the police. |

## Why No Outsider Can Hack an Account Back

A hacked account comes back through the platform, not through a stranger's skills. When you use Instagram's recovery steps, Instagram decides by checking things only the owner should have: the email or phone on the account, a login link, a security code, or a video selfie. Instagram's [hacked account help page](https://help.instagram.com/149494825257596) describes those checks and points people to instagram.com/hacked. A paid outsider cannot pass those checks for you without the same access you already have.

Platforms also say plainly what they will never ask for. TikTok's [phishing page](https://support.tiktok.com/en/safety-hc/account-and-user-safety/avoid-fraudulent-message-attacks-on-tiktok) says TikTok will never contact you to ask for your password, verification codes or other sensitive personal information. Meta's [scam prevention page](https://www.meta.com/safety/topics/safety-basics/tools/scams/) describes user support scams where someone poses as company support, sends a lookalike login page and asks for a password and even a two-factor code, then takes over the account. A "hacker" asking for the same things is running the same play under a different label.

> Warning: **MCMC's warning on recovery offers.** In a [media statement on 25 September 2026](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/MEDIA-STATEMENT_MCMC-INVESTIGATING-COMPLAINTS-RELATED-TO-WHATSAPP-ACCOUNTS.pdf), MCMC reminded the public to be cautious of parties offering account recovery services in exchange for money, personal information or verification codes. The statement was about hacked and blocked WhatsApp accounts. It advised affected users to recover or appeal through WhatsApp's official channels, not to share verification codes or security PINs, and to turn on two-step verification.

## Red Flags Checklist: Is This a Recovery Scam?

One of these is enough reason to walk away.

- They contacted you first, in comments, a DM or a message request.
- They call themselves a hacker, an ethical hacker, a cyber expert or an insider at Meta, TikTok or Google.
- They want your password, a login code, a backup code, or for you to install a remote access app.
- They promise a result, a time ("within 2 hours") or a guarantee.
- They insist on Telegram or WhatsApp only and have no company you can check independently.
- They want payment upfront, to a personal bank account, an e-wallet, gift cards or cryptocurrency.
- Their proof is screenshots, testimonials and comments from accounts with few posts or friends.
- New fees appear after you pay, each with a technical-sounding name.
- They offer to hack the person who hacked you, or to find out who they are.
- They pressure you: the account will be deleted tonight unless you act now.

The FTC, the United States consumer protection agency, gives advice that fits this scam well: in its guide to [refund and recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) it says that anyone who unexpectedly contacts you and asks for an upfront fee is a scammer, and that legitimate organisations will not guarantee you will get your money back.

## What Legitimate Recovery Help Looks Like

You can recover most accounts yourself through the platform's own forms, and that is where to start. If you do look for outside help, an honest provider behaves in a recognisably different way.

*How a recovery scammer differs from legitimate help.*

| Question | Recovery scammer | Legitimate help |
| --- | --- | --- |
| Who makes contact? | They find you in comments or DMs | You approach them through their own website |
| Who are they? | A nickname and a Telegram handle | A named company and people you can check independently |
| What do they ask for? | Password, codes, remote access | Screenshots, dates, emails from the platform; never passwords or codes |
| How do they work? | "Hacking", "tools", "insiders" | The platform's official forms and appeals, prepared properly |
| What do they promise? | A guaranteed result by a set time | Best effort, with the platform making the final decision |
| First step | Pay now | A case review that may tell you that you can do it yourself |

Honest helpers also tell you the hard part up front: some accounts do not come back, whatever anyone does. For a fuller checklist on vetting any provider before you contact them, see our guide on [how to check whether a recovery service is legitimate](https://www.awarexone.com/research/is-account-recovery-service-legit-how-to-check).

## The Official Routes to Use Instead

Go straight to the platform, by typing the address yourself or opening the app, never through a link someone sent you.

- Instagram: instagram.com/hacked, or "Forgot password?" on the login screen, as set out on Instagram's hacked account help page.
- Facebook: the hacked account steps in the Facebook Help Center, linked from Meta's [phishing help page](https://www.meta.com/help/policies/1273750300141929/).
- TikTok: the account recovery steps in the TikTok app and its official help centre.
- Google and Gmail: Google's own account recovery form. Google says you cannot call Google to sign in.
- WhatsApp: the official WhatsApp app and help centre. MCMC says complaints unresolved through WhatsApp's channels can be lodged with MCMC.

If you are still in the first hours after a takeover, our [first hour checklist for a hacked Instagram account](https://www.awarexone.com/research/instagram-hacked-first-hour) puts these steps in order.

## If You Already Paid or Shared a Code in Malaysia

Act on the money and the codes first, then the account. Scammers target people at their most stressed, so there is no shame in this.

1. Stop paying. No further payment will bring the account or the money back.
2. Call your bank's 24-hour hotline or the NSRC on 997 as soon as you can. The [NSRC FAQ](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) says quick action can help reduce losses, though there is no guarantee of getting money back.
3. Make a police report at the nearest station. The NSRC advises contacting your bank or 997 first, then the police.
4. If you shared a code, change the password of the account that code belonged to, from the official app, and log out other sessions. If it was a WhatsApp code, open WhatsApp on your own phone and turn on two-step verification, as MCMC advises.
5. Secure your email first if it may be affected, because whoever controls the inbox can reset everything else.
6. Keep every chat, username, phone number, bank account number, receipt and link. The NSRC says to have the transaction details ready and to be prepared to give police evidence such as chat screenshots, links and receipts.

The NSRC also says that NSRC, PDRM, MCMC, BNM and banks will not ask for your password, PIN, TAC or OTP. Expect a second wave of fake helpers who claim they can recover your money; our guide to [what to do after losing money to a recovery scammer](https://www.awarexone.com/research/lost-money-to-recovery-scammer-what-now) covers that stage in detail.

## How to Report a Fake Recovery Hacker

- On the platform: report the account and the comments as a scam or fraud. Meta's phishing page lists the only email domains Meta uses, such as facebookmail.com and meta.com, which helps you spot fake "Meta" emails.
- Telegram or WhatsApp: report and block the contact inside the app.
- CyberSecurity Malaysia's [Cyber999](https://www.cybersecurity.my/portal-main/services/cyber999-overview): report phishing links and fake login pages by online form, email, phone or its mobile app.
- MCMC: for WhatsApp account problems that stay unresolved through WhatsApp's official channels, as its September 2026 statement describes.
- Your bank, 997 and the police: whenever money moved.

Do not try to trick the scammer, test them or get your money back by bargaining. Every extra message gives them more about you, and none of it helps the police.

## When a Case Review Makes Sense

Most people should start with the official routes above, and many recover their account that way without anyone's help. A second opinion can help when the scammer took codes and you no longer know which accounts they control, when a business account is involved, or when the platform's forms keep looping. SocialSafe by AwareXone, our recovery service, starts every request with a case review and works only through the platform's official processes. It is best effort, the platform decides, and sometimes the honest answer is that nothing more can be done or that you can finish it yourself. Read how we approach [account security](https://www.awarexone.com/services/account-security), and our [Trust Center](https://www.awarexone.com/trust) sets out what we will never ask for, starting with your password and codes.

## Frequently Asked Questions

### Are ethical hackers on Instagram who recover accounts real?

No. Real ethical hackers test systems with written permission from the owner and do not offer to break into platforms for strangers. An Instagram profile selling account recovery through hacking is a scam.

### Is there a Meta rep I can pay to get my account back?

No. Meta says it has no general public phone number for customer service, and its support routes are its help centres and, for subscribers, Meta Verified support. Anyone selling access to a Meta insider is lying.

### I gave the hacker my OTP. What now?

Change the password for the account that code belonged to straight away from the official app, log out other devices and turn on two-step verification. If money moved, call your bank or 997 and make a police report.

### Can I get my money back from a fake recovery hacker?

Sometimes, if you report quickly. Call your bank's hotline or the NSRC on 997 and make a police report, but the NSRC says there is no guarantee funds can be recovered.

### Why do so many comments recommend the same hacker?

The recommending accounts are usually fake or hacked accounts run by the scammers to build false trust. Real customers rarely post the same praise in identical words under strangers' posts.

## Official sources

- [Meta Safety Center: Scam prevention (read 5 October 2026)](https://www.meta.com/safety/topics/safety-basics/tools/scams/)
- [Meta Help Center: Avoid scams and phishing attempts (read 5 October 2026)](https://www.meta.com/help/policies/1273750300141929/)
- [Meta Help Center: Phone support availability on Meta products (read 5 October 2026)](https://www.meta.com/help/policies/23938634512490588/)
- [Instagram Help Center: How to fix and secure hacked Instagram profiles (read 5 October 2026)](https://help.instagram.com/149494825257596)
- [TikTok Support: Avoid fraudulent message attacks on TikTok (read 5 October 2026)](https://support.tiktok.com/en/safety-hc/account-and-user-safety/avoid-fraudulent-message-attacks-on-tiktok)
- [Google Account Help: How to recover your Google Account or Gmail (read 5 October 2026)](https://support.google.com/accounts/answer/7682439?hl=en)
- [MCMC: Media statement, MCMC investigating complaints related to WhatsApp accounts, 25 September 2026 (read 5 October 2026)](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/MEDIA-STATEMENT_MCMC-INVESTIGATING-COMPLAINTS-RELATED-TO-WHATSAPP-ACCOUNTS.pdf)
- [Malay Mail (Bernama): Police warn of double scam trapping victims with fake recovery offers, 13 April 2026 (read 5 October 2026)](https://www.malaymail.com/news/malaysia/2026/04/13/pay-more-lose-more-police-warn-of-double-scam-trapping-victims-with-fake-recovery-offers/216147)
- [FTC Consumer Advice: Refund and recovery scams (read 5 October 2026)](https://consumer.ftc.gov/articles/refund-and-recovery-scams)
- [NFCC: National Scam Response Centre FAQ (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc)
- [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview)

---

AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.