# Hacker Holding Your Account for Ransom? Don't Pay

> A hacker wants money to return your Instagram or Facebook? Why paying rarely works, what to do instead, and how to report extortion in your country.

- URL: https://www.awarexone.com/research/hacker-holding-account-ransom-should-i-pay
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026-10-14
- Topics: Account recovery, Malaysia
- Related service: Social media problem solutions: https://www.awarexone.com/all-types-of-social-media-problem-solutions

## Short answer

Generally, no. Paying a hacker who's holding your account to ransom gives you no promise you'll get it back. It marks you as someone who pays, and it funds the next attack. The safer path is the platform's official recovery route (instagram.com/hacked, facebook.

## Summary

- Paying doesn't promise return, and the hacker can simply ask for more.
- Keep every message, username, wallet address and payment request.
- Start official recovery immediately, and report the extortion.
- Never send codes. Hackers often ask for "one more code" to take your email too.
- For sextortion, the UK NCSC lists sextortion as a specific threat with its own guidance, and every country listed below takes reports.

Generally, no. Paying a hacker who's holding your account to ransom gives you no promise you'll get it back. It marks you as someone who pays, and it funds the next attack. The safer path is the platform's official recovery route (instagram.com/hacked, facebook.com/hacked, and so on), plus a report to the police or your national fraud reporting service, keeping all of the hacker's messages as evidence. If the threat involves intimate images, treat it as sextortion: stop engaging, don't pay, preserve evidence, and report it.

## Why paying usually doesn't work

- **No enforcement.** The hacker has no reason to keep their word once paid.
- **Repeat demands.** Paying shows you'll pay. "Unlock fees" and "final payments" often follow.
- **Retained access.** Even if they hand the account back, they may keep a session, add a backup email, or know your password patterns.
- **Funding crime.** Payments support the same networks that hack other people.

Regulators give similar advice about recovery-for-a-fee offers in general. The FTC warns that anyone who contacts you asking for an upfront fee to recover something you lost is a scammer ([FTC](https://consumer.ftc.gov/articles/refund-and-recovery-scams)).

> "When someone has already paid a ransom or a 'hacker for hire', they typically still do not have the account, and they may have shared codes that deepened the compromise. Law enforcement and the FTC advise against paying. We pick up from securing email and using official recovery only." - Md Shariar Shanaz Shuvon, Founder, AwareXone

## What should I do instead?

1. **Stop replying** after you've saved the evidence. Don't argue or negotiate.
2. **Screenshot everything:** usernames, messages, phone numbers, crypto wallet addresses, payment instructions.
3. **Secure your email** and any account that shares the same password ([NCSC](https://www.ncsc.gov.uk/section/respond-recover/hacked-accounts)).
4. **Start official recovery:**

- [instagram.com/hacked](https://www.instagram.com/hacked) - [facebook.com/hacked](https://www.facebook.com/hacked) - [TikTok hacked-account help](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked) - [WhatsApp compromised-account help](https://faq.whatsapp.com/1131652977717250)

1. **Warn your contacts** that the hacker may message them as you.
2. **Report the extortion** (see below).

## Where do I report account ransom or extortion?


| Country | Where |
| --- | --- |
| Malaysia | Police report. If money was paid, call your bank or NSRC 997 right away ([MyGOV](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline)) |
| Singapore | SPF online police report. ScamShield 1799 for advice ([ScamShield](https://www.scamshield.gov.sg/i-have-been-scammed/)) |
| UK | Report Fraud, 0300 123 2040. Police Scotland on 101 ([Report Fraud](https://www.reportfraud.police.uk/social-media-hacking/)) |
| Australia | ReportCyber, and Scamwatch if a scam was involved ([cyber.gov.au](https://www.cyber.gov.au/report-and-recover/recover-from/account-compromise/other)) |
| UAE | MoI eCrimes, Dubai Police eCrime, Abu Dhabi Police Aman, or 999 ([UAE portal](https://www.uaesupremecouncil.org/en/information-and-services/justice-safety-and-the-law/cyber-safety-and-digital-security.html)) |

## What if they're threatening to leak photos or messages?

That's sextortion or blackmail, and it's a crime. The UK NCSC lists sextortion as one of the situations it gives individuals specific guidance on ([NCSC](https://www.ncsc.gov.uk/section/respond-recover/you)). General steps:

- Don't pay, and stop engaging
- Preserve evidence, but don't share the images further
- Report to the police and to the platform
- Talk to someone you trust

AwareXone has a Malaysia-focused guide: [sextortion on social media in Malaysia](https://www.awarexone.com/research/sextortion-social-media-malaysia).

## What if they're selling my username back to me?

Attackers sometimes take over accounts with valuable handles and offer to "sell" them back. Same advice: don't pay. Use the official recovery flow with your original email or phone. See [Instagram username stolen after hack](https://www.awarexone.com/research/instagram-username-stolen-after-hack).

## What if I already paid?

1. Contact your bank or payment provider right away.
2. Report the payment, with the wallet address or account details, to the authorities above.
3. Change passwords everywhere the hacker might have reached, starting with email.
4. Expect more demands, and don't pay again.
5. Watch out for "recovery agents" who promise to get your ransom back. See [lost money to a recovery scammer](https://www.awarexone.com/research/lost-money-to-recovery-scammer-what-now).

## Can a recovery service negotiate with the hacker?

A legitimate one shouldn't. AwareXone, for example, works only through official platform processes, never negotiates with or pays attackers, never asks for passwords or OTPs, and doesn't promise outcomes.

## How do ransom demands usually arrive?

- A DM from your own hacked account to you, or to your contacts, saying "pay to get it back"
- An email from an address the attacker added to the account
- Messages on WhatsApp or Telegram after the attacker finds your number
- Threats to delete the account, post embarrassing content, or sell the username

Whatever the format, the advice is the same: save the evidence, don't pay, start official recovery, and report.

## What evidence helps police and platforms most?

- Screenshots showing the sender's username or number and the full demand
- Wallet addresses, bank details or payment links
- Dates and times of every message
- Security emails from the platform showing what the hacker changed
- Your report reference numbers

## How do I stop it happening again?

- A unique password for every account, kept in a password manager
- Two-factor authentication, or passkeys where available
- Never share login codes, even with "friends" or "support"
- A secure, separate email for important accounts
- Regular checks of active sessions and connected apps

## What about accounts held by ex-partners or ex-employees?

When the person holding your account is someone you know, like an ex-partner, a former employee or an agency, it's still unauthorised control, and demands for money are still extortion. Gather proof of ownership, use the platform's recovery and business support routes, and report threats to the police. See [former employee holds company accounts](https://www.awarexone.com/research/former-employee-holds-company-social-accounts).

## Bottom line

Don't pay. Save the evidence, recover the account through official routes, report the extortion, and lock down every account the attacker might reach next.

> Note: **About this guide.** **About the publisher:** This guide is published by AwareXone, whose Malaysia-based recovery service, SocialSafe by AwareXone, works only through official platform channels. See the [SocialSafe by AwareXone social media account recovery page](https://www.awarexone.com/all-types-of-social-media-problem-solutions), [pricing](https://www.awarexone.com/pricing) and the [Trust Center](https://www.awarexone.com/trust).

Last checked: 14 October 2026. Platform policies change; always confirm steps on the provider's own help pages before you act.

SocialSafe by AwareXone works only through official platform channels, never asks for passwords or one-time codes, and states that platforms make the final decision. See the [Trust Center](https://www.awarexone.com/trust) and [pricing](https://www.awarexone.com/pricing) for how a case review works.

### Will the hacker give my account back if I pay?

There's no promise. Many victims report more demands after paying. Official recovery plus a police report is safer.

### Is it illegal to pay a ransom for my account?

This depends on your country and the circumstances, and it's a legal question beyond this guide. Either way, paying is risky and is generally discouraged.

### Should I keep talking to the hacker?

Save evidence, then stop engaging. Continued contact gives them more use.

### Can the police trace the hacker?

Sometimes, especially with evidence like wallet addresses and phone numbers. Report quickly and include everything.

### Is account ransom a crime?

Yes. Unauthorised access and extortion are criminal offences in Malaysia, the UK, Australia, Singapore and the UAE. Report it to the police in your country.

### Will the platform help if a hacker is demanding money?

Use the platform's hacked-account flow and report the extortion messages. Platforms don't negotiate with attackers, and neither should you.

### Should I delete the ransom messages?

No. Keep them as evidence for the police and the platform, and screenshot the sender's profile.

## Official sources

- [FTC, Refund and Recovery Scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams)
- [NCSC, Hacked accounts](https://www.ncsc.gov.uk/section/respond-recover/hacked-accounts)
- [NCSC, Advice for individuals](https://www.ncsc.gov.uk/section/respond-recover/you)
- [MyGOV NSRC 997](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline)
- [ScamShield](https://www.scamshield.gov.sg/i-have-been-scammed/)
- [Report Fraud (Oct 2026)](https://www.reportfraud.police.uk/social-media-hacking/)
- [ACSC](https://www.cyber.gov.au/report-and-recover/recover-from/account-compromise/other)
- [UAE government portal](https://www.uaesupremecouncil.org/en/information-and-services/justice-safety-and-the-law/cyber-safety-and-digital-security.html)

---

AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.