Friends Scammed From My Hacked Account: What to Do

A friend calls to say they transferred money to "you" an hour ago. The message came from your account, it used your name and photo, and it sounded like you. You never sent it. Someone took over your account, asked your contacts for an urgent loan, and at least one person paid.

The short answer: speed on the money side matters most, and it is your friend's call to make, not yours. They contact their own bank or NSRC on 997 now and then make a police report. You make a separate police report about the hack, secure the account, and stop the scam reaching anyone else.

This guide splits the jobs between the two of you, lists the evidence each person needs, and covers the follow-up scams aimed at people who have just lost money. It is general information, not legal advice.

Last checked: 5 October 2026.

#What Should You Do If Friends Were Scammed Through Your Hacked Account?

Ask the friend who paid to call their bank's 24-hour fraud hotline or the National Scam Response Centre on 997 immediately, because it is their account and their transaction. Then they make a police report at the nearest station with the receiving account number, amount, time and screenshots. You make your own police report saying your account was hacked and that you did not receive the money. Secure the account through the platform's official hacked page, warn other contacts from a different channel, and refuse any offer to recover the money for a fee.

#Who Does What: You and the Friend Who Paid

Your friend has a bank transaction to report. You have a hacked account and your name attached to a fraud. Splitting the work stops each of you waiting on the other.

#For the Friend Who Paid: The First Calls

The NSRC's FAQ on the NFCC website says that when money has been transferred, the victim should immediately contact their bank's hotline, which it says runs 24 hours a day, or the NSRC on 997. It adds that acting quickly can reduce losses, though there is no guarantee the money comes back. The government's NSRC 997 page says to call within 24 hours of realising you were scammed so that accounts and transactions can be blocked.

1. Call the bank you sent the money from, using the number on the back of the card or in the banking app. Do not use a number from the chat or a search ad.
2. If the bank line is busy, call 997. Say that the money went to a scammer posing as a friend through a hacked social media account.
3. Make a police report at the nearest police station. The NSRC FAQ advises calling the bank or 997 first, then making the report within 24 hours, because without it the police cannot follow up.
4. Keep the police report number and the bank's case reference. The investigating officer may contact you for more detail.
5. Do not send any more money, even if the "friend" messages again with a new reason.

If more than 24 hours have passed, the NSRC FAQ says the victim should still report to the bank, even though the chance of recovering the money is lower.

#For You: Why Your Own Police Report Matters

Your friend's police report will name the account that asked for money, and that account carries your name, photo and perhaps your phone number. A report of your own puts on record, early and in your words, that the account was taken from you and that the money did not go to you. It also gives you a reference number to quote to the platform, your bank and anyone who asks.

• The platform, your username and the profile link.
• When you last had normal access and when you noticed the takeover.
• Any email or SMS from the platform about a changed password, email or phone, with the time.
• The names of friends who told you they were contacted, and who paid, if they agree to be named.
• A plain statement that you did not send the messages, did not ask for money and did not receive any.

Whether anyone has to repay anyone is a legal and personal question that this guide cannot answer. If it becomes a dispute, speak to a lawyer. What you can do now is make sure the facts are recorded quickly and honestly. Our guide on what to bring to a police report for a hacked account goes through the paperwork in more detail.

#Evidence Checklist for Both of You

The NSRC FAQ lists what victims should have ready when reporting to the bank, 997 or the police: a short chronology, personal details, the suspect's details, the account numbers, amount and time of the transaction, the receipt, any links the scammer shared, and the conversation itself. It says police may also ask for screenshots of chats and social media pages.

#Check the Receiving Account on Semak Mule

PDRM's Semak Mule portal lets anyone check whether a bank account number, phone number or company name already has police reports against it. The government's scammer account verification page describes it the same way. The portal is a search tool. At the time of writing it offers searches, not a report form.

• A match tells you others have reported the same account. Mention it to the bank and the police.
• No match does not mean the account is safe. New mule accounts appear all the time.
• The way to add the account to the record is your friend's police report, which carries the account number.

Our walkthrough of checking a number or account on Semak Mule explains the categories and what the results mean.

#Secure the Hacked Account and Stop More Requests

While your friend handles the bank, cut the attacker off so nobody else pays. Meta's page on a friend's account sending spam says possible causes include malware or login details stolen by phishing, and its phishing guide warns that one fraudulent link can lead to several accounts being taken, including email and WhatsApp.

1. Secure the email address on the account first: new password, sign out of other sessions, remove forwarding rules you did not set.
2. Facebook: go to facebook.com/hacked, ideally on a device you have logged in with before, as Facebook's hacked account page recommends. If the email was changed, Facebook says it sends a link to the previous address that lets you reverse the change.
3. Instagram: follow Instagram's hacked profile steps. An email from [email protected] about a changed email may include a "secure my account" option.
4. WhatsApp: re-register the number with the six-digit code sent by SMS or phone call. WhatsApp's compromised account guide says this logs out everyone else, that you should recover before reporting the account, and that you should warn family and friends.
5. Once back in, turn on two-factor authentication, check linked devices and remove apps you do not recognise.
6. Delete scam messages only after you and your friends have screenshots.

Then warn people from a channel you control. Our guide to a hacked account messaging your friends has a short warning you can adapt, and covers what to do while the attacker is still sending requests.

#How These Scams Usually Sound in Malaysia

Meta's scam guidance lists "people claiming to be a friend or relative in an emergency" and requests to move the chat off Facebook among the warning signs. In Malaysia the request often arrives in the owner's usual language, short and casual, asking for a quick transfer to an account that "belongs to my cousin" or "my boss". Illustrative examples of the style:

• English: "Can you transfer to this account first? My online banking is down, I return you tonight."
• Bahasa Malaysia: "Boleh pinjam duit sekejap? Akaun aku kena block, esok aku bayar balik."
• Chinese: "可以先帮我转一点钱吗？我的银行出问题，明天还你。"

The common thread is urgency, a reason the real person cannot be called, and a bank account in someone else's name. Share these with older relatives so the next request gets a phone call, not a transfer.

#Fund Recovery Agents: The Second Scam

Soon after a loss, your friend may be contacted by someone claiming they can trace and return the money: a "lawyer", a "bank officer", an "NSRC agent" or a recovery company with good-looking reviews. The NSRC FAQ says NSRC, PDRM, MCMC, BNM and banks will only contact you after you have reported, and will never ask for your username, password, PIN, TAC or OTP.

• They contact the victim first, often through a comment, a DM or a Telegram group.
• They want an upfront payment, a "processing" charge or a tax before the money is released.
• They ask for banking login details, a TAC or OTP, or remote access to a phone.
• They promise a certain result or a fixed date.
• They claim special links to the police, a bank or the platform.
• They push for secrecy and speed.

Any one of these is enough to stop. If your friend has already paid a recovery agent, our guide to losing money to a recovery scammer covers the next calls. The same rules apply to anyone offering to get your social account back: legitimate help works through the platform's official processes only, starts by reviewing the case, never asks for passwords, OTP or backup codes, and cannot promise anything because the platform makes the final decision.

#Other Places to Report

• The platform: report the messages and, once you have recovered the account, any copies or clones. On WhatsApp, recover first, as WhatsApp warns that reporting the account you are trying to recover may get it banned.
• CyberSecurity Malaysia: if the takeover started with a phishing link or fake login page, report it to Cyber999, which takes incident reports by online form, email, phone and app and helps users escalate abuse reports.
• MyCERT's social media and online fraud FAQ collects the official recovery and reporting links for the main platforms.

#When a Case Review Makes Sense

Everything above can be done without anyone's help, and the money side belongs with your friend, the bank, NSRC and the police. Outside help is worth considering only for the account itself: when the platform's recovery keeps looping, when the attacker changed the email, phone and two-factor settings, or when the account is a business still being used to scam customers. SocialSafe by AwareXone, our recovery service, reviews the case first and tells you honestly whether an official route is still open. It works through the platforms' own forms, is best effort, and cannot chase or return money. Our account security service explains how we work, and the Trust Center sets out what we never ask for, starting with passwords, login codes and backup codes.

#Frequently Asked Questions