Hacked Account Messaging Friends for Money: What to Do

Your cousin sends a screenshot: a message from your Facebook asking her to transfer money "just until tomorrow". You never wrote it. Or it is the other way round, and an old school friend has just asked you to forward a six-digit code, or to join a crypto group that "doubled my savings".

Either way, treat the account as taken over until the real person confirms otherwise on a separate channel. The owner secures the email and uses the official recovery page. Everyone else stops, calls the person on a saved number, and sends nothing, not money and not codes.

This guide covers both sides: what to do if it is your account, what to do if a friend's account is asking you, how to handle crypto and investment posts, and where to report in Malaysia if money has already gone.

Last checked: 29 September 2026.

#What Should You Do If a Hacked Account Is Messaging Your Friends?

If the account is yours, secure the email address linked to it, then go to the platform's official hacked account page (such as facebook.com/hacked or instagram.com/hacked) and follow the steps. Warn your contacts from a channel the attacker cannot reach, such as a phone call or another app. If the account belongs to a friend, do not reply with money, codes or personal details; call them on the number you already have and tell them what you saw. If anyone has sent money, they should call their bank's hotline or the National Scam Response Centre on 997 at once, then make a police report. Nobody outside the platform can promise the account will come back.

#Is It Hacked, Cloned or Really Your Friend?

Three different things can look the same in a chat window. A hacked account is the real account, now controlled by someone else. A cloned account is a new profile that copies the name and photo. And sometimes the message really is from your friend. The first step differs for each.

Meta's help page on a friend's account sending spam says the account may be compromised through malicious software or login details stolen by phishing. Its phishing guide adds that when bad actors take control of an account, they sometimes use it to send spam or inappropriate content to the owner's friends and family.

If the problem is a copy of your profile rather than a takeover, our guide to getting a fake profile removed covers the reporting route.

#If It Is Your Account: Stop the Messages First

This is stressful, and people you care about are being targeted in your name. The priority is to cut the attacker off, then protect your contacts. Work in this order:

1. Secure the email account linked to your social media. Change its password, sign out other sessions and remove any forwarding rule you did not set. Whoever holds that inbox can reset your accounts again.
2. Check your inbox for a message about a changed email address. Facebook's page on recovering a hacked account says it sends a special link to the previous address that lets you reverse the change. Instagram's hacked account help says a message from [email protected] may include a "secure my account" option.
3. Go to facebook.com/hacked or instagram.com/hacked, ideally on a phone or computer you have logged in with before. Facebook recommends a device you have used for that account.
4. If you can still log in, change the password. Instagram's page on unauthorised posts and comments says changing the password logs out every device that was signed in.
5. Remove third-party apps you do not recognise, turn on two-factor authentication, confirm the phone number and email on the account, and remove linked accounts you do not know in Accounts Center. Instagram lists each of these steps on the same page.
6. Delete scam posts and check sent messages to see who was contacted.

Meta's phishing guide warns that one fraudulent link can lead to several accounts being taken, including email and WhatsApp. So check every account that shares the same email or password, not just the one your friends noticed. Our walkthrough of the first hour after an Instagram hack goes step by step if that is the account involved.

#How to Warn Friends Without Helping the Scammer

Warn people from a channel you control: a phone call, SMS, a different app, or another account they know is yours. The attacker can delete a warning posted from the hacked account. Keep it short and specific, for example:

My Facebook account was hacked. If you get a message from it asking for money, a code or an investment, it is not me. Please do not reply or send anything. Akaun Facebook saya digodam. Jangan hantar wang atau kod kepada akaun itu.

• Tell close family first, especially parents and older relatives, because they are the people most likely to act quickly on an urgent request that appears to come from you.
• Ask anyone who received a message to take a screenshot before blocking, so you have evidence for your report.
• Do not share a link to the scam post in your warning. Describe it instead.
• Once you are back in, post a short notice on the account itself so followers who missed your message still see it.

#If a Friend's Account Is Asking You for Money or a Code

Stop before you reply. Meta's newsroom described friend-in-need scams as messages sent from friends' compromised accounts, or from unknown numbers claiming the friend lost their phone, asking for money, personal information or a six-digit code. In the same piece, WhatsApp advised never to share that code with anyone, including friends and family.

1. Do not send money, a code, a photo of your IC or a bank screenshot while you are unsure.
2. Call your friend on the number already saved in your phone, not a number the chat gives you. A live conversation is better than a voice note, because voices can now be imitated.
3. Ask something only they would know, not something that appears on their profile.
4. If the message names a bank account or phone number, check it on PDRM's Semak Mule portal. The government's scammer account verification page says it lets you check phone numbers, bank account numbers and company names linked to fraud. A clean result does not prove an account is safe.
5. Report the message or profile inside the app. Instagram says you can report content through the three dots above a post, by holding a message, or from the profile, as described in its security update.
6. Tell your friend what you received, with a screenshot, so they can start their recovery and warn others.

Meta's help page on avoiding scams on Facebook lists warning signs that fit these messages: people claiming to be a friend or relative in an emergency, requests to move the chat off Facebook, and urgent requests tied to a problem with your account.

#When a Hacked Account Posts Crypto or Investment Offers

Takeovers are often used to advertise. The attacker posts stories about how much the owner has "earned" trading crypto or forex, shares screenshots of profits, and invites followers to message for details. Followers trust the face they know, which is the whole point.

Meta's scam guidance describes investment scams that promise to turn a small amount into a much larger one, including "cash flipping", Ponzi and get-rich-quick schemes, and notes that scammers typically disappear with the payment. Instagram's page on unauthorised content says an account sharing things you did not post may have a compromised password.

• Owner: follow the recovery steps above, then delete every scam post and story. Tell followers in a new post that the offers were not yours and that anyone who paid should contact their bank and NSRC.
• Follower: do not message the account. Report the post, then contact the owner another way.
• Anyone offered an investment: search the platform or company name on the Securities Commission Malaysia Investor Alert List, which lists unauthorised websites, products, entities and individuals. Not being listed does not make an offer legitimate.
• Anyone who already paid: stop sending more, even if the "platform" says one more payment will unlock your profits.

The government's NSRC 997 page lists investment scams and cryptocurrency scams among the types NSRC handles.

#If Money Was Sent or a Code Was Shared

Speed matters here. The government's NSRC page says to call 997 within 24 hours of discovering the scam so authorities can act to block bank accounts and transactions, to contact the bank involved, and to make a police report at the nearest police station.

1. Call your bank's fraud hotline and NSRC on 997. Have the date, amount, receiving account number and screenshots ready.
2. Make a police report at a police station, and keep the report number.
3. If a code was shared, secure that account immediately and turn on two-factor authentication.
4. Report the security incident to CyberSecurity Malaysia. Its Cyber999 service is the national point of contact for computer security incidents and takes reports by online form, email, phone and mobile app.
5. Report the hacked profile to the platform so it can act on the account.

Which agency handles what is covered in more detail in our guide to reporting a hacked account in Malaysia.

#Mistakes That Make It Worse

• Replying to the scammer to "test" them. It only gives them more to work with.
• Deleting the chat before taking screenshots. Your bank, the police and the platform may all want to see it.
• Warning people only from the hacked account, where the attacker can delete your post.
• Changing the social media password but leaving the email account open.
• Paying someone who offers to break into the account for you or to trace lost crypto. That is usually a second scam aimed at the same victim.
• Clicking a "Meta Support" link sent by DM. Instagram has said it will never send you a DM about your account, and that genuine messages from it appear under "Emails from Instagram" in settings.

#When Expert Recovery Help Makes Sense

Most people can stop the messages and warn their contacts using the steps above. Outside help is worth considering when the official page keeps looping, when the attacker changed the email, phone and two-factor settings, or when a business account is sending scams to customers. SocialSafe by AwareXone, our recovery service, looks at the case first and tells you honestly whether an official route is still open, using only the platforms' own forms and appeals. Our account security service explains how that works, and our Trust Center sets out what we never ask for: no passwords, no login codes and no backup codes.

#Frequently Asked Questions