# Is an Account Recovery Service Legit? How to Check > How to tell if an account recovery service in Malaysia is legit or a scam: a checklist to run before you pay or share anything, and the red flags to walk from. - URL: https://www.awarexone.com/research/is-account-recovery-service-legit-how-to-check - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: Account recovery, Scams, Malaysia - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer Some recovery help is real and a lot is not. A legitimate helper works only through the platform's own processes, never needs your password or codes, and never promises the account back. Check the company, the written scope and how it handles evidence before you share anything, and walk away if anyone asks for codes or remote access. ## Summary - A legitimate recovery helper can only use the same official platform routes you can use, so check how it works before you share anything. - Run the checklist first: a real company and people you can verify, written scope, clear evidence handling, and honesty that the platform decides. - Walk away at once if anyone asks for your password, a login code, backup codes, remote access to your phone, or claims a private desk at Meta. - Google says it works with no account recovery service, and Meta says it has no general public support phone number, so treat any claimed special line to either company as a warning sign. - MCMC warns the public about parties offering account recovery in exchange for money, personal information or verification codes. - If you already paid or shared a code in Malaysia, call your bank or the NSRC on 997 straight away and make a police report. You lost your Instagram, Facebook, TikTok or WhatsApp account, the official forms went nowhere, and now someone online says they can get it back. Maybe it is a page with recovery screenshots, a comment under your post, or a friend of a friend on Telegram. You want to know if they are real before you send money or details. The short answer: some recovery help is real, and a lot of it is not. A legitimate helper can only work through the platform's own processes, never needs your codes, and never promises the account back. You can check most of that in ten minutes, before you share anything. This guide gives you a checklist to run on any provider, the red flags that should end the conversation, and what to do if you have already paid. Last checked: 5 October 2026. ## How Do You Check If an Account Recovery Service Is Legit? Check five things before you pay or share anything. Can you verify the company and the people behind it on your own, outside their page? Will they put the scope in writing? Do they explain how they store and delete your evidence? Do they tell you the official routes exist and that you can use them yourself? Do they say plainly that the platform decides and that some accounts do not come back? If the answer to any of these is no, or if they ask for your password, a login code, backup codes or remote access, stop. That last rule applies to every provider, without exception. ## What Real Recovery Help Can and Cannot Do Understanding the limits is the fastest way to spot a fake. Nobody outside a platform can restore an account by pressing a button. Real help means reading your case, choosing the right official route, preparing the evidence the platform asks for, and making the request clear and consistent. The platforms say this themselves. Google's [account recovery help page](https://support.google.com/accounts/answer/7682439?hl=en) says you cannot call Google for help signing in, that Google does not work with any service that claims to provide account or password support, and that you should not give out your passwords or verification codes. Meta's page on [phone support availability](https://www.meta.com/help/policies/23938634512490588/) says Meta, including Facebook, Instagram and WhatsApp, does not have a general public phone number for customer service, and that phone numbers claiming to be Meta support are potentially scams. Meta notes that specialised phone support may exist in some jurisdictions or for some products, so the safe habit is to find any contact route yourself, inside the official help centre. So a legitimate helper is, at most, a well-prepared guide to the same doors you already have. Anyone claiming a different door is the problem. If you are still deciding whether to try this alone or bring someone in, see [when it actually makes sense to get professional account recovery help](https://www.awarexone.com/research/when-to-get-professional-account-recovery-help). ## The Buyer's Checklist: Run It Before First Contact Work through this list with the provider's website, its replies and a search engine open. You do not need to tell them anything about your account to answer these questions. *Seven checks to run on any account recovery provider before you share details or pay.* | Check | What a legitimate provider shows | Warning sign | | --- | --- | --- | | Who they are | A named company and named people you can look up independently, with a consistent history across their own site and other sources | Only a nickname, a stock photo, or a page created recently with no trace elsewhere | | How you reach them | A website with its own domain, a business email address and published terms | Telegram or a personal chat account as the only contact, with nothing in writing | | Scope in writing | A written description of what they will and will not do before any commitment | "Just send the username and we start now" | | Evidence handling | A clear explanation of what documents they need, where they keep them and when they delete them | Requests for your MyKad, selfies and bank details with no reason or retention policy | | Official routes | They name the platform's own forms and tell you that you can use them yourself | They say the official routes do not work and only they have the way in | | Honesty about outcomes | They say the platform makes the final decision and some accounts are not restored | Promises, countdowns, or a recovery percentage with no published basis | | Your secrets | They state they will never ask for your password, OTP, backup codes or remote access | Any request for a code, a screenshot of a code, or an app that lets them control your phone | A provider that passes every row has not proved it will recover your account. It has shown it is working honestly inside the rules. That is the most anyone outside the platform can offer. ## Hard Red Flags That End the Conversation Some signs are not worth weighing against anything else. If you see one of these, stop replying, keep the evidence and do not pay. - They ask for your password, a login code, an OTP, backup codes or your WhatsApp verification code. Nobody legitimate needs these, and sharing one can hand over the next account too. - They ask you to install a remote access or screen sharing app, or to send cookies or a session file from your browser. Those give them control of your device or your logged-in session. - They claim to have a contact, a representative or a private desk inside Meta, TikTok or Google. Google says it works with no recovery service, and Meta says it has no general public support line. - They offer to break into the account, trace the hacker or attack the person who took it. That is unlawful, and the person offering it is the more likely thief. - They promise the account back, or offer a refund promise that only applies after you pay more. - They push for full payment upfront, in cryptocurrency, or by transfer to a personal bank account, and get impatient when you ask questions. - Their proof is a set of screenshots or reviews you can find word for word on other pages, or testimonials with no way to check them. - They contacted you first, in a comment, a DM or a message after you posted about being hacked. > Warning: **The same warning from official sources.** MCMC's [media statement of 25 September 2026](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/MEDIA-STATEMENT_MCMC-INVESTIGATING-COMPLAINTS-RELATED-TO-WHATSAPP-ACCOUNTS.pdf) reminds the public to be cautious of parties offering account recovery services in exchange for money, personal information or verification codes. The US Federal Trade Commission's page on [refund and recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) says legitimate organisations will not guarantee you get your money back and warns against anyone who insists on payment by cryptocurrency, gift cards or wire transfer. The NSRC says the police, NSRC and banks will never ask for your password, PIN, TAC or OTP. ## Questions to Ask Before You Agree to Anything A short, polite message with these questions sorts most providers in one reply. Honest ones answer plainly. Scammers dodge, rush you, or change the subject to payment. 1. What is your company name, and where can I check it outside your own page? 2. Which official platform route would you use for a case like mine? 3. What exactly will you do, and what will you not do? Can I have that in writing? 4. What documents will you need from me, where will you keep them, and when will you delete them? 5. Will you ever need my password, a login code or access to my phone? 6. What happens if the platform says no? The answer to question five should be a simple no. The answer to question six should admit that it can happen. If either answer is anything else, you have your verdict. ## How Recovery Scams Usually Sound in Malaysia Scam offers arrive in English, Bahasa Malaysia and Chinese, and the scripts are similar in all three. Common lines include "admin Meta" or "pegawai TikTok" titles, "boleh recover dalam masa singkat", "confirm dapat balik" style promises, or Chinese posts offering to retrieve any account. A real provider does not need a title borrowed from a platform, and a real platform employee does not sell recovery through comments. In September 2026 MCMC noted public concern about WhatsApp accounts reported as hacked, blocked or inaccessible. Its statement says hacked and blocked WhatsApp accounts are two different problems, tells users to recover or appeal through WhatsApp's official channels, and says that if the issue stays unresolved there, users may lodge a complaint with MCMC for referral to Meta. That is a free, official escalation path that no paid helper can replace. For how the whole fake hacker routine plays out, see our guide to [fake hackers offering account recovery](https://www.awarexone.com/research/fake-hackers-offering-account-recovery-scam), and for the classic impersonation version, our piece on [fake Meta support messages](https://www.awarexone.com/research/fake-meta-support-scam-malaysia). ## Try the Free Official Routes First Before you judge any provider, make sure you have tried what is free. A provider that discourages this is one to avoid. - Use the recovery or appeal link inside the platform's own app or help centre, opened by typing the address yourself. - For a Google account, use Google's recovery steps. Google says wrong guesses will not lock you out of the recovery process and there is no limit on attempts. - For WhatsApp, use in-app support and the official appeal, then MCMC if it stays unresolved, as MCMC's statement describes. - Secure the email address and phone number linked to the account, because whoever controls them can reset it again. - Collect screenshots of every notice, email and message with the date visible. If you want to know what a case actually involves before talking to anyone, our walkthrough of [what to prepare before an account recovery case](https://www.awarexone.com/research/what-to-prepare-before-account-recovery-case) lists the evidence platforms tend to ask for. ## If You Already Paid or Shared a Code Act on the money first, then the accounts. The NSRC's [FAQ on the NFCC website](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) tells fraud victims to contact their bank's 24 hour hotline or the NSRC on 997 immediately, and to make a police report within 24 hours so the police can follow up. 1. Call your bank or 997 and report the transfer. Have the date, amount and recipient account details ready. 2. Make a police report at the nearest station, bringing screenshots of the chat, the payment receipt and the scammer's profile links. 3. If you shared a login code or password, change the password on that account and on your email, and log out other sessions where you still can. 4. If you installed a remote access app, uninstall it and change passwords from a different device. 5. Report the scammer's profile or page on the platform where they contacted you, and report a phishing site to CyberSecurity Malaysia's [Cyber999 incident response centre](https://www.cybersecurity.my/portal-main/services/cyber999-overview). 6. Expect a second approach. The FTC notes that people who have been scammed once are often targeted again by someone promising to get the money back. Do not pay them either. Our step-by-step guide on [losing money to a recovery scammer](https://www.awarexone.com/research/lost-money-to-recovery-scammer-what-now) goes through each of these in more detail. ## When a Case Review Makes Sense Many people recover access alone with the official routes and the evidence above. Outside help is worth considering when the account carries a business or income, when a hack and a ban are tangled together, or when the email and phone on the account are both gone. SocialSafe by AwareXone, our recovery service, starts with a case review and tells you honestly whether an official route is still open, including when you can do it yourself. We work only through the platforms' own processes, the platform makes the final decision, and we never ask for your password, login codes or backup codes. Hold us to the same checklist: our [account security service](https://www.awarexone.com/services/account-security) describes the work, and our [Trust Center](https://www.awarexone.com/trust) sets out how we handle evidence and what we will never ask for. ## Frequently Asked Questions ### Are all account recovery services scams? No, but many offers are. A legitimate provider works only through official platform routes, explains its scope in writing and never asks for your codes. The checklist above separates the two quickly. ### Can someone recover my hacked account without my password? Yes, and a real helper should never ask for it. Platform recovery is built for people who have lost their password, so any provider that needs yours is not using the official route. ### Is it safe to pay a recovery service upfront? Be very cautious. Pressure to pay everything upfront, in cryptocurrency or to a personal bank account is a common scam pattern, and the FTC says only scammers insist on payment by methods such as cryptocurrency, gift cards or wire transfer. ### Does Meta or Google have official recovery agents I can hire? No. Google says it does not work with any service claiming to provide account or password support, and Meta says numbers claiming to be its customer support are potentially scams. ### Where can I report a fake recovery service in Malaysia? If you lost money, call your bank or the NSRC on 997 and make a police report. You can also report the profile to the platform and a phishing site to Cyber999. ### Does AwareXone ask for my password or OTP? Never. AwareXone reviews the case first, uses only official platform processes and cannot promise an outcome, because only the platform can restore an account. ## Official sources - [Google Account Help: How to recover your Google Account or Gmail (read 5 October 2026)](https://support.google.com/accounts/answer/7682439?hl=en) - [Meta Help Center: Phone support availability on Meta Company Products (read 5 October 2026)](https://www.meta.com/help/policies/23938634512490588/) - [MCMC: Media statement, MCMC investigating complaints related to WhatsApp accounts, 25 September 2026 (read 5 October 2026)](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/MEDIA-STATEMENT_MCMC-INVESTIGATING-COMPLAINTS-RELATED-TO-WHATSAPP-ACCOUNTS.pdf) - [US Federal Trade Commission: Refund and recovery scams (read 5 October 2026)](https://consumer.ftc.gov/articles/refund-and-recovery-scams) - [NFCC: National Scam Response Centre FAQ (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.