Instagram Business Account Hacked in Malaysia: What to Do

Your Instagram is your shop. This morning the password stopped working, or it still works but posts and Direct Messages are going out that you never wrote. Some customers are already asking why your account sent them a new bank account number.

The short answer: get control of the login first, then look for the second door. On a professional account, a hacker can add themselves in Meta Business Suite and keep acting even after you change the password. After that, protect the linked Facebook Page and ad payments, and warn customers before anyone pays a fake invoice.

This guide is for Malaysian sellers and small brands. It covers recovery, removing hidden access, customer damage, reporting in Malaysia and fake recovery help.

Last checked: 5 October 2026.

#What Should You Do If Your Instagram Business Account Is Hacked?

If you are locked out, go to instagram.com/hacked in a browser, or use the "secure my account" link in Instagram's email telling you the email address changed. If you can still log in but the hacker keeps posting, open Meta Business Suite on a computer, go to "Business Settings" and then "People", and look for names you do not know. Change your password, turn on two-factor authentication, and tell customers from a channel you still control not to pay anything requested through Instagram until you confirm it is safe. If you are locked out, only Instagram and Meta can decide whether the account comes back.

#Can You Still Log In? Pick Your Starting Point

A business takeover usually looks like one of these situations. Match yours first, because the right fix depends on whether you still have the login. The labels on your screen can differ slightly by app version and region.

#Locked Out: Recover the Account Through Instagram First

Recovery always goes through Instagram's own tools. Instagram's page for a hacked Instagram profile lists the routes in order, and notes that some may not be available for every account type, so try them all.

1. Check the inbox you used for the shop's Instagram. If an email from [email protected] says the email was changed, select "secure my account" in that message to undo the change.
2. On the login screen, tap "Forgot password?", enter the username, email or phone, and choose "Send login link". Open the link only from your own email or SMS.
3. If neither works, request support from Instagram on a mobile device and give a secure email address that only you can open. There is no public Instagram support email to write to directly; see why that is and what the request-support flow actually does if you are tempted to search for one.
4. If the account has photos of you, Instagram may ask for a video selfie turning your head. For an account without photos of you, Instagram asks for the email or phone you signed up with and the type of device you used at sign up.

If the account only ever showed products and logos, the video selfie route may not apply, so the sign-up email, phone and original device matter more. Instagram says the video selfie is never shown on Instagram and is deleted within 30 days. If the attacker also swapped the phone number, our guide to an Instagram account with the email and phone changed goes through that case.

Before you do any of this, secure the email account itself. Instagram's security tips put it plainly: anyone who can read your email can probably also get into your Instagram. Change that email password and make it different from every other password you use.

#Logged In but the Hacker Is Still Posting: Check Meta Business Suite

This is the problem that makes business accounts different. Instagram has a help page for exactly this case: you have a professional account and can log in, but a hacker is still taking actions. Changing the password does not remove someone who was added to the business side.

1. On a desktop computer, go to Meta Business Suite at business.facebook.com.
2. Log in with your Instagram details.
3. Select "Business Settings" on the left, then "People" under "Users".
4. Look for business manager names you do not recognise in the business portfolio.
5. If there are any, Instagram's fix is to switch the Instagram account back to a personal account, which removes them, then switch back to a professional account if you need it.

While logged in, also follow Instagram's list for owners who still have access: change the password, turn on two-factor authentication, confirm the email and phone are yours, remove unknown linked accounts in Accounts Center, and revoke suspicious third-party apps.

#Check the Linked Facebook Page, Ads and Payments

A business Instagram rarely stands alone. It is often connected to a Facebook Page, a business portfolio and an ad account with your card saved on it. Meta's page on a hacked or compromised business portfolio lists the signs to look for:

• New users or admins added without approval, or permissions changed.
• New or reactivated ad accounts or campaigns your team did not create.
• Sudden increases in ad spend, invoices or charges.
• Posts with copy, images or targeting that do not look like your business.

Meta says to contact Meta Support straight away if you see these, so it can stop fraudulent activity early. Afterwards it recommends completing "Security Checkup" in your business portfolio settings, requiring two-factor authentication for everyone, removing users whose email addresses are not directly related to the business, and reviewing shared credit lines. If your card shows charges you did not authorise, call your card issuer too.

If you lost the Facebook Page as well, Facebook's hacked Page recovery form is the route. You must be logged in, and Facebook says it can only act when it can confirm the Page was compromised. If your personal Facebook account is the one that was taken, start at facebook.com/hacked, as Facebook's hacked account page advises. Our guide to a Facebook Page hacked with admins removed covers the Page side in detail.

#Warn Customers Before They Pay a Fake Invoice

The money risk usually lands on your customers. An attacker with your shop account can reply to orders, post a "new bank account" notice, or run a fake sale. Warn people from every channel you still control: your Facebook Page, website, WhatsApp Business, email list or marketplace store.

Our Instagram account has been hacked. Please do not make any payment requested through Instagram messages or posts until we confirm here that the account is safe again. Our bank details have not changed. / Akaun Instagram kami telah digodam. Jangan buat sebarang bayaran yang diminta melalui mesej atau hantaran Instagram sehingga kami sahkan di sini bahawa akaun itu selamat semula. Butiran bank kami tidak berubah.

Leave links out of the warning, because scammers copy warnings too. Our piece on a hacked account messaging your contacts explains how these follower scams usually run and what to say to people who reply.

#If a Customer Already Paid the Scammer

Point them to their bank and the National Scam Response Centre straight away. The NSRC's FAQ on the NFCC website says a victim should contact their bank's 24-hour hotline or the NSRC on 997 as soon as they notice the fraud, then make a police report at the nearest police station within 24 hours. It says to call the bank or 997 first, before the police report, so action starts quickly, and that acting fast can reduce losses although there is no guarantee the money comes back.

Give the customer screenshots of the messages from your hacked account and its URL. Make your own police report too, so there is a record that your business was the victim of the takeover, not part of the scam.

#Report the Incident in Malaysia

Beyond the police report, CyberSecurity Malaysia runs Cyber999, the national point of contact for reporting computer security incidents. You can report through its online form, email, phone or the Cyber999 app. Its page asks for details such as the source of the attack, the time and any logs or email headers, so keep the phishing message or fake login page if that is how the attacker got in.

If the takeover began with a fake "Meta copyright" message, include it. Instagram's page on recent emails from Instagram says it never contacts you about account security through Direct Messages, and lists the addresses its security emails come from, such as @mail.instagram.com.

#Evidence Checklist for a Business Takeover

Collect this while it is fresh. It helps with Instagram's identity checks, Meta Support and the police report.

• The shop's username, profile URL and the date you last had normal access.
• The sign-up email and phone number, and the type of phone you used when you created the account.
• Emails from [email protected] about email, phone or password changes, saved in a folder rather than deleted.
• Screenshots of posts, Stories and DMs the attacker sent, with the date visible.
• Screenshots of unknown names under "People" in Meta Business Suite before you remove them.
• Ad receipts and card statements showing charges you did not make.
• Your police report number and any Cyber999 or bank reference numbers.

#Lock the Shopfront Down Afterwards

Once you are back in, close the doors the attacker used. Instagram's security tips call two-factor authentication the single most effective step to protect your account from hackers. Its two-factor help page recommends an authentication app, because you can add several devices to get codes, and says backup codes let you log in if you lose your phone.

• Turn on two-factor authentication with an authentication app on the owner's phone, and store the backup codes offline.
• Give staff and agencies their own access in Meta Business Suite rather than sharing the Instagram password.
• Check "People" in Meta Business Suite every month and remove anyone who has left.
• Keep the account's email on an inbox the business owns, with its own two-factor protection.

If the first hour of a takeover is still unfolding, our first hour checklist for a hacked Instagram puts these steps in time order.

#How Legitimate Recovery Help Works, and How to Spot a Scammer

Shop owners who post about a hack are often contacted by "recovery experts". A genuine service reviews your case before anything is agreed, uses only Instagram's and Meta's official processes, works on a best-effort basis, and tells you plainly that Meta decides and that some accounts do not come back.

Treat any of these as a warning sign:

• They ask for your password, a login code, an SMS code or your backup codes.
• They promise guaranteed recovery or name a fixed number of hours.
• They claim inside contacts at Meta or a special back door into Instagram.
• They message you first in comments or DMs, in English, Bahasa Malaysia or Chinese, after you posted about the hack.
• They offer to hack the attacker back or to take the account by force.
• They want payment before they will even look at the case, or push you to decide quickly.

#When a Case Review Makes Sense

Plenty of shop owners recover with the steps above and never need anyone else. A second pair of eyes helps when the email and phone were both changed, when the Instagram account, Facebook Page and ad account were all taken together, or when the account carries most of your sales and you cannot afford a rejected identity check. SocialSafe by AwareXone, our recovery service in Malaysia, looks at the case first and tells you honestly whether an official route is still open, and sometimes that answer is that you can finish it yourself. You can read how we approach business and creator recovery, and our Trust Center sets out what we never ask for, starting with your password and login codes.

#Frequently Asked Questions