Is an Account Recovery Service Legit? How to Check

You lost your Instagram, Facebook, TikTok or WhatsApp account, the official forms went nowhere, and now someone online says they can get it back. Maybe it is a page with recovery screenshots, a comment under your post, or a friend of a friend on Telegram. You want to know if they are real before you send money or details.

The short answer: some recovery help is real, and a lot of it is not. A legitimate helper can only work through the platform's own processes, never needs your codes, and never promises the account back. You can check most of that in ten minutes, before you share anything.

This guide gives you a checklist to run on any provider, the red flags that should end the conversation, and what to do if you have already paid.

Last checked: 5 October 2026.

#How Do You Check If an Account Recovery Service Is Legit?

Check five things before you pay or share anything. Can you verify the company and the people behind it on your own, outside their page? Will they put the scope in writing? Do they explain how they store and delete your evidence? Do they tell you the official routes exist and that you can use them yourself? Do they say plainly that the platform decides and that some accounts do not come back? If the answer to any of these is no, or if they ask for your password, a login code, backup codes or remote access, stop. That last rule applies to every provider, without exception.

#What Real Recovery Help Can and Cannot Do

Understanding the limits is the fastest way to spot a fake. Nobody outside a platform can restore an account by pressing a button. Real help means reading your case, choosing the right official route, preparing the evidence the platform asks for, and making the request clear and consistent.

The platforms say this themselves. Google's account recovery help page says you cannot call Google for help signing in, that Google does not work with any service that claims to provide account or password support, and that you should not give out your passwords or verification codes. Meta's page on phone support availability says Meta, including Facebook, Instagram and WhatsApp, does not have a general public phone number for customer service, and that phone numbers claiming to be Meta support are potentially scams. Meta notes that specialised phone support may exist in some jurisdictions or for some products, so the safe habit is to find any contact route yourself, inside the official help centre.

So a legitimate helper is, at most, a well-prepared guide to the same doors you already have. Anyone claiming a different door is the problem. If you are still deciding whether to try this alone or bring someone in, see when it actually makes sense to get professional account recovery help.

#The Buyer's Checklist: Run It Before First Contact

Work through this list with the provider's website, its replies and a search engine open. You do not need to tell them anything about your account to answer these questions.

A provider that passes every row has not proved it will recover your account. It has shown it is working honestly inside the rules. That is the most anyone outside the platform can offer.

#Hard Red Flags That End the Conversation

Some signs are not worth weighing against anything else. If you see one of these, stop replying, keep the evidence and do not pay.

• They ask for your password, a login code, an OTP, backup codes or your WhatsApp verification code. Nobody legitimate needs these, and sharing one can hand over the next account too.
• They ask you to install a remote access or screen sharing app, or to send cookies or a session file from your browser. Those give them control of your device or your logged-in session.
• They claim to have a contact, a representative or a private desk inside Meta, TikTok or Google. Google says it works with no recovery service, and Meta says it has no general public support line.
• They offer to break into the account, trace the hacker or attack the person who took it. That is unlawful, and the person offering it is the more likely thief.
• They promise the account back, or offer a refund promise that only applies after you pay more.
• They push for full payment upfront, in cryptocurrency, or by transfer to a personal bank account, and get impatient when you ask questions.
• Their proof is a set of screenshots or reviews you can find word for word on other pages, or testimonials with no way to check them.
• They contacted you first, in a comment, a DM or a message after you posted about being hacked.

#Questions to Ask Before You Agree to Anything

A short, polite message with these questions sorts most providers in one reply. Honest ones answer plainly. Scammers dodge, rush you, or change the subject to payment.

1. What is your company name, and where can I check it outside your own page?
2. Which official platform route would you use for a case like mine?
3. What exactly will you do, and what will you not do? Can I have that in writing?
4. What documents will you need from me, where will you keep them, and when will you delete them?
5. Will you ever need my password, a login code or access to my phone?
6. What happens if the platform says no?

The answer to question five should be a simple no. The answer to question six should admit that it can happen. If either answer is anything else, you have your verdict.

#How Recovery Scams Usually Sound in Malaysia

Scam offers arrive in English, Bahasa Malaysia and Chinese, and the scripts are similar in all three. Common lines include "admin Meta" or "pegawai TikTok" titles, "boleh recover dalam masa singkat", "confirm dapat balik" style promises, or Chinese posts offering to retrieve any account. A real provider does not need a title borrowed from a platform, and a real platform employee does not sell recovery through comments.

In September 2026 MCMC noted public concern about WhatsApp accounts reported as hacked, blocked or inaccessible. Its statement says hacked and blocked WhatsApp accounts are two different problems, tells users to recover or appeal through WhatsApp's official channels, and says that if the issue stays unresolved there, users may lodge a complaint with MCMC for referral to Meta. That is a free, official escalation path that no paid helper can replace. For how the whole fake hacker routine plays out, see our guide to fake hackers offering account recovery, and for the classic impersonation version, our piece on fake Meta support messages.

#Try the Free Official Routes First

Before you judge any provider, make sure you have tried what is free. A provider that discourages this is one to avoid.

• Use the recovery or appeal link inside the platform's own app or help centre, opened by typing the address yourself.
• For a Google account, use Google's recovery steps. Google says wrong guesses will not lock you out of the recovery process and there is no limit on attempts.
• For WhatsApp, use in-app support and the official appeal, then MCMC if it stays unresolved, as MCMC's statement describes.
• Secure the email address and phone number linked to the account, because whoever controls them can reset it again.
• Collect screenshots of every notice, email and message with the date visible.

If you want to know what a case actually involves before talking to anyone, our walkthrough of what to prepare before an account recovery case lists the evidence platforms tend to ask for.

#If You Already Paid or Shared a Code

Act on the money first, then the accounts. The NSRC's FAQ on the NFCC website tells fraud victims to contact their bank's 24 hour hotline or the NSRC on 997 immediately, and to make a police report within 24 hours so the police can follow up.

1. Call your bank or 997 and report the transfer. Have the date, amount and recipient account details ready.
2. Make a police report at the nearest station, bringing screenshots of the chat, the payment receipt and the scammer's profile links.
3. If you shared a login code or password, change the password on that account and on your email, and log out other sessions where you still can.
4. If you installed a remote access app, uninstall it and change passwords from a different device.
5. Report the scammer's profile or page on the platform where they contacted you, and report a phishing site to CyberSecurity Malaysia's Cyber999 incident response centre.
6. Expect a second approach. The FTC notes that people who have been scammed once are often targeted again by someone promising to get the money back. Do not pay them either.

Our step-by-step guide on losing money to a recovery scammer goes through each of these in more detail.

#When a Case Review Makes Sense

Many people recover access alone with the official routes and the evidence above. Outside help is worth considering when the account carries a business or income, when a hack and a ban are tangled together, or when the email and phone on the account are both gone. SocialSafe by AwareXone, our recovery service, starts with a case review and tells you honestly whether an official route is still open, including when you can do it yourself. We work only through the platforms' own processes, the platform makes the final decision, and we never ask for your password, login codes or backup codes. Hold us to the same checklist: our account security service describes the work, and our Trust Center sets out how we handle evidence and what we will never ask for.

#Frequently Asked Questions