Lost Money to a Recovery Scammer? What to Do Now

You paid someone who promised to get your hacked Instagram back, or to recover money you lost to an earlier scam. Then came another fee, and another. Now they have stopped replying, or they are asking for more, and you feel foolish on top of being out of pocket.

You are not the first, and you can still act today. Stop paying, call your bank or the NSRC on 997, make a police report, and lock down any account you gave them details for. Then watch for the next fake helper.

This guide covers what to do in the first hour, what to bring to the bank and the police, how to protect your accounts, and how to tell real help from the next scam.

Last checked: 5 October 2026.

#What Should You Do If a Recovery Scammer Took Your Money?

Stop all payments and all contact with the person, even if they promise a refund after one more fee. Call your bank's 24-hour hotline or the National Scam Response Centre (NSRC) on 997 as soon as you can, then make a police report at the nearest station within 24 hours. Save every chat, receipt and profile link before anything disappears. If you shared a password, a login code or your identity card, secure your email and accounts next. The NFCC's NSRC page is clear that acting fast can reduce losses, but there is no guarantee you will get the money back.

#How Recovery Scams Catch People a Second Time

A recovery scam targets someone who has already lost something: an account, or money. The scammer promises to get it back, but only after you pay first. The US Federal Trade Commission's guide to refund and recovery scams describes the pattern plainly: they call the upfront money a retainer, a processing fee, an administrative charge or a tax, and if you pay, you lose more.

In Malaysia the same script appears in English, Bahasa Malaysia and Chinese. People search for it afterwards as "kena tipu dua kali" or "被骗了又被骗". The two common versions are:

• The fake account recovery hacker. An advert, comment or direct message offers to recover a hacked or disabled account. They ask for your login details, a code, or a photo of your MyKad, take a deposit, then invent new costs.
• The fake fund recovery agent. Someone claims they can trace and return money lost to an investment, job or shopping scam. They often say they work with the police, NSRC or a law firm.

Both end the same way: rising fees, nothing recovered, and a scammer who now holds more of your details.

#The First Hour: Money, Contact, Evidence

1. Stop paying. Do not send a "release fee", "unlock fee" or "tax" to get back what you already paid. That is the next stage of the same scam.
2. Call your bank's 24-hour hotline, printed on the back of your card or on the bank's website, or call the NSRC on 997. NFCC says that if you cannot get through to 997, you should call your bank directly.
3. Screenshot the whole conversation before you block anyone. Scammers often delete messages or their profile once they realise you have stopped paying.
4. Make a police report at the nearest station within 24 hours of calling the bank or 997. NFCC says that without a report, the police cannot follow up.
5. Stop replying. Do not argue or tell them you have reported them. Mute the chat to keep it as evidence.

#What to Tell Your Bank, NSRC and the Police

NFCC lists the information you need when you report an online financial scam to your bank, 997 or a police station. Gather it before you go, and bring the screenshots on your phone and on paper if you can.

Tell the officer about both losses in the same report. If you feel awkward admitting you paid a "hacker", describe exactly what you asked for and paid anyway; the facts matter more than a tidy story. Our guide on what to bring to a police report goes through the station visit in more detail.

After the report, NFCC says you follow up with the investigating officer assigned to your case, or the Commercial Crime Investigation Department (JSJK) at your district police headquarters, not through 997. PDRM's Online Check System FAQ says you can log in and choose "Status Repot" to check a report made under your own identity card number. Bank Negara Malaysia's fraud page lists its BNMTELELINK contact centre for wider questions. For the 997 call itself, see what happens when you call the NSRC.

#Check the Scammer's Number and Account in Semak Mule

Semak Mule is a PDRM portal run by JSJK. The government portal entry for it says you can check whether a phone number, bank account number or company name is linked to fraud. Go to semakmule.rmp.gov.my yourself rather than following a link someone sends you.

Check every number and account the scammer used, including the one for the "recovery fee". A match supports your report. No match does not mean the account is safe; it may simply not have been reported yet, and your report may be what adds it. Our walkthrough on checking a scammer's number in Semak Mule explains how to read the results.

#If You Shared Passwords, Codes or Your MyKad

A fake recovery hacker usually asks for the very things that let them take your account: your password, the code sent by SMS, a backup code, or a photo of your ID. If you gave any of these, assume the scammer can still get in.

1. Secure your email first. Whoever controls the inbox can reset your social accounts. Google's guide to securing a hacked Google Account says to review recent security events and devices, check the recovery phone and email, and remove forwarding rules or filters you did not set up.
2. Change the password on every account that used the same password, starting with email, banking and the account they promised to recover.
3. Sign out of all other sessions in each app's security settings, so anyone already logged in is thrown out.
4. Turn on two-factor authentication, and store the backup codes somewhere only you can reach.
5. Check that the recovery email and phone number on each social account are still yours.
6. If you sent a photo of your MyKad, tell your bank so it can watch for accounts or loans opened in your name, and mention it in your police report.

If the scammer has already locked you out of the account, go back to the platform's own recovery flow. Our guide to the first hour after an Instagram hack shows the official routes. Never send a code to anyone who says they will use it to fix the account, including someone who claims to be from AwareXone.

#Report the Scam Profile Where You Found It

Reporting does not bring money back, but it can stop the same profile reaching the next person. Facebook's page on avoiding scams says it removes content that defrauds people for money, and its warning signs match recovery scams closely: advance fees, urgent messages about your account, and requests to move the chat off Facebook.

• On Facebook, open the profile, choose "Options" and then "Report profile", as Facebook's guide to reporting a profile describes, then pick the option that fits best.
• On other apps, use the report option on the profile, the chat or the advert itself.
• Copy the profile link before you report or block, because it may be harder to find afterwards.

#The Third Wave: Fake NSRC Officers, Police and Lawyers

After a second loss, expect a third approach. In April 2026 the JSJK director at Bukit Aman warned that a syndicate was posing as NSRC representatives, advertising on Facebook and then contacting victims on WhatsApp to offer to recover their money for an upfront fee, as reported by FMT. Victims paid into several bank accounts and kept being asked for more, without getting anything back.

PDRM has already had to disown one version of this. In May 2025, Bukit Aman's Commercial Crime Investigation Department said a Facebook advertisement using the PDRM name and logo to promise fraud victims their money back had no connection to the police and was itself a fraudulent attempt, as reported by Bernama via Malay Mail. Separately, a PDRM statement reported by Utusan said that returning blocked scam money is handled only by the investigating officer under the law, with no shortcut through agents or other organisations. Treat any offer that borrows a police, NSRC or lawyer's name the same way: verify it directly with the agency before paying anything.

The FBI's Internet Crime Complaint Center describes the same tactic abroad in its warning about fictitious law firms offering to recover funds: fake lawyers who already know the exact amounts you lost and ask for "bank fees" to release the money.

#Real Help Versus Another Recovery Scammer

Use this quick check on anyone offering to get money or an account back.

For account recovery services in particular, our checklist on whether a recovery service is legitimate covers the questions to ask before you share anything, and our explainer on fake hackers offering recovery shows where those offers appear.

#Mistakes That Make Things Worse

• Paying "one last fee" to unlock a refund. There is no final fee in a recovery scam.
• Waiting days before calling the bank out of embarrassment. NFCC says late reports leave little chance of tracing the money.
• Calling 997 but never making the police report.
• Deleting the chats in anger before taking screenshots.
• Trusting a new "recovery agent" because they already know your loss.

#Will You Get Your Money or Your Account Back?

Be honest with yourself about the odds. NFCC says quick action can reduce losses but there is no guarantee the money comes back, and that once money has been gone for some time the chance is slim. Any money that is returned comes through the bank and the police process, not through a third party. A hacked or disabled social account is a separate question: only the platform can restore it, and some accounts are never restored.

#When a Case Review Makes Sense

Everything above can be done alone, and the money side belongs with your bank and the police. Where a second opinion can help is the account side: if the scammer still has access to your email or social accounts, if you are not sure what they changed, or if the account you wanted back is still locked. SocialSafe by AwareXone, AwareXone's recovery service, looks at the case before anything is agreed, works only through the platforms' official processes, and will tell you if there is nothing more an outside party can do. You can read how our account security work runs, and our Trust Center explains what we will never ask for, starting with your password and login codes.

#Frequently Asked Questions