# Lost Money to a Recovery Scammer? What to Do Now > Paid a fake hacker or recovery agent in Malaysia and lost money? Stop paying, call your bank or NSRC 997, make a police report and lock down your accounts. - URL: https://www.awarexone.com/research/lost-money-to-recovery-scammer-what-now - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: Scams, Account security, Malaysia - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer Stop paying and stop contact. Call your bank's 24-hour hotline or the NSRC on 997 at once, then make a police report within 24 hours. Keep the chats and receipts, check the scammer's number in Semak Mule, report their profile, and secure any account you shared details for. Nobody can promise the money comes back. ## Summary - If you paid someone to recover an account or lost money and they took more, stop paying and stop replying today, even if they promise one last fee. - Call your bank's 24-hour hotline or the NSRC on 997 straight away, then make a police report at the nearest station within 24 hours. - Keep every chat, transfer receipt, phone number, bank account number and profile link, and check the number and account in PDRM's Semak Mule portal. - If you gave them a password, a login code or your MyKad, secure your email first, change passwords, sign out other sessions and turn on two-factor authentication. - Expect a third approach from people posing as NSRC, police or lawyers who want a fee to get your money back, because real agencies never charge for that. - Nobody can promise your money or your account will come back, and only the bank, the police process and the platform decide what is returned. You paid someone who promised to get your hacked Instagram back, or to recover money you lost to an earlier scam. Then came another fee, and another. Now they have stopped replying, or they are asking for more, and you feel foolish on top of being out of pocket. You are not the first, and you can still act today. Stop paying, call your bank or the NSRC on 997, make a police report, and lock down any account you gave them details for. Then watch for the next fake helper. This guide covers what to do in the first hour, what to bring to the bank and the police, how to protect your accounts, and how to tell real help from the next scam. Last checked: 5 October 2026. ## What Should You Do If a Recovery Scammer Took Your Money? Stop all payments and all contact with the person, even if they promise a refund after one more fee. Call your bank's 24-hour hotline or the National Scam Response Centre (NSRC) on 997 as soon as you can, then make a police report at the nearest station within 24 hours. Save every chat, receipt and profile link before anything disappears. If you shared a password, a login code or your identity card, secure your email and accounts next. The [NFCC's NSRC page](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) is clear that acting fast can reduce losses, but there is no guarantee you will get the money back. ## How Recovery Scams Catch People a Second Time A recovery scam targets someone who has already lost something: an account, or money. The scammer promises to get it back, but only after you pay first. The US Federal Trade Commission's guide to [refund and recovery scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams) describes the pattern plainly: they call the upfront money a retainer, a processing fee, an administrative charge or a tax, and if you pay, you lose more. In Malaysia the same script appears in English, Bahasa Malaysia and Chinese. People search for it afterwards as "kena tipu dua kali" or "被骗了又被骗". The two common versions are: - The fake account recovery hacker. An advert, comment or direct message offers to recover a hacked or disabled account. They ask for your login details, a code, or a photo of your MyKad, take a deposit, then invent new costs. - The fake fund recovery agent. Someone claims they can trace and return money lost to an investment, job or shopping scam. They often say they work with the police, NSRC or a law firm. Both end the same way: rising fees, nothing recovered, and a scammer who now holds more of your details. ## The First Hour: Money, Contact, Evidence 1. Stop paying. Do not send a "release fee", "unlock fee" or "tax" to get back what you already paid. That is the next stage of the same scam. 2. Call your bank's 24-hour hotline, printed on the back of your card or on the bank's website, or call the NSRC on 997. NFCC says that if you cannot get through to 997, you should call your bank directly. 3. Screenshot the whole conversation before you block anyone. Scammers often delete messages or their profile once they realise you have stopped paying. 4. Make a police report at the nearest station within 24 hours of calling the bank or 997. NFCC says that without a report, the police cannot follow up. 5. Stop replying. Do not argue or tell them you have reported them. Mute the chat to keep it as evidence. > Warning: **If they send money into your account.** Some fake agents send a small "refund" and ask you to pass part of it on, or say they paid too much by mistake. Stop and tell your bank. NFCC notes that accounts can be blocked when they are suspected of being used as mule accounts, and the FTC says a "refund" for more than you lost, with a request to send back the difference, is always a scam. ## What to Tell Your Bank, NSRC and the Police NFCC lists the information you need when you report an online financial scam to your bank, 997 or a police station. Gather it before you go, and bring the screenshots on your phone and on paper if you can. *Evidence to gather for a recovery scam report, based on the NFCC's NSRC FAQ at the time of writing.* | What to bring | Where to find it | | --- | --- | | A short timeline of both scams, in date order | Your chats and bank history | | Every transfer: date, time, amount and receiving account number | Your banking app, receipts, CDM slips | | The scammer's name, phone numbers and usernames | Chat headers, profile pages, call logs | | Links to the advert, profile or website that found you | Copy the URL, not just a screenshot | | Screenshots of the full conversation | Messaging apps, social media inboxes or email | | Your name, phone, MyKad number and bank account | Your MyKad and bank card | Tell the officer about both losses in the same report. If you feel awkward admitting you paid a "hacker", describe exactly what you asked for and paid anyway; the facts matter more than a tidy story. Our guide on [what to bring to a police report](https://www.awarexone.com/research/police-report-hacked-account-malaysia-what-to-bring) goes through the station visit in more detail. After the report, NFCC says you follow up with the investigating officer assigned to your case, or the Commercial Crime Investigation Department (JSJK) at your district police headquarters, not through 997. PDRM's [Online Check System FAQ](https://sso.rmp.gov.my/FAQ.aspx) says you can log in and choose "Status Repot" to check a report made under your own identity card number. [Bank Negara Malaysia's fraud page](https://www.bnm.gov.my/web/financial-fraud-alert/report-a-fraud) lists its BNMTELELINK contact centre for wider questions. For the 997 call itself, see [what happens when you call the NSRC](https://www.awarexone.com/research/nsrc-997-scam-hotline-what-happens). ## Check the Scammer's Number and Account in Semak Mule Semak Mule is a PDRM portal run by JSJK. The [government portal entry for it](https://www.malaysia.gov.my/en/topics/scammer-account-verification-portal) says you can check whether a phone number, bank account number or company name is linked to fraud. Go to [semakmule.rmp.gov.my](https://semakmule.rmp.gov.my/) yourself rather than following a link someone sends you. Check every number and account the scammer used, including the one for the "recovery fee". A match supports your report. No match does not mean the account is safe; it may simply not have been reported yet, and your report may be what adds it. Our walkthrough on [checking a scammer's number in Semak Mule](https://www.awarexone.com/research/semak-mule-check-scammer-number-malaysia) explains how to read the results. ## If You Shared Passwords, Codes or Your MyKad A fake recovery hacker usually asks for the very things that let them take your account: your password, the code sent by SMS, a backup code, or a photo of your ID. If you gave any of these, assume the scammer can still get in. 1. Secure your email first. Whoever controls the inbox can reset your social accounts. Google's guide to [securing a hacked Google Account](https://support.google.com/accounts/answer/6294825) says to review recent security events and devices, check the recovery phone and email, and remove forwarding rules or filters you did not set up. 2. Change the password on every account that used the same password, starting with email, banking and the account they promised to recover. 3. Sign out of all other sessions in each app's security settings, so anyone already logged in is thrown out. 4. Turn on two-factor authentication, and store the backup codes somewhere only you can reach. 5. Check that the recovery email and phone number on each social account are still yours. 6. If you sent a photo of your MyKad, tell your bank so it can watch for accounts or loans opened in your name, and mention it in your police report. If the scammer has already locked you out of the account, go back to the platform's own recovery flow. Our guide to [the first hour after an Instagram hack](https://www.awarexone.com/research/instagram-hacked-first-hour) shows the official routes. Never send a code to anyone who says they will use it to fix the account, including someone who claims to be from AwareXone. ## Report the Scam Profile Where You Found It Reporting does not bring money back, but it can stop the same profile reaching the next person. Facebook's page on [avoiding scams](https://www.facebook.com/help/1674717642789671/) says it removes content that defrauds people for money, and its warning signs match recovery scams closely: advance fees, urgent messages about your account, and requests to move the chat off Facebook. - On Facebook, open the profile, choose "Options" and then "Report profile", as Facebook's guide to [reporting a profile](https://www.facebook.com/help/report) describes, then pick the option that fits best. - On other apps, use the report option on the profile, the chat or the advert itself. - Copy the profile link before you report or block, because it may be harder to find afterwards. ## The Third Wave: Fake NSRC Officers, Police and Lawyers After a second loss, expect a third approach. In April 2026 the JSJK director at Bukit Aman warned that a syndicate was posing as NSRC representatives, advertising on Facebook and then contacting victims on WhatsApp to offer to recover their money for an upfront fee, as [reported by FMT](https://www.freemalaysiatoday.com/category/bahasa/tempatan/2026/04/13/2-kali-ditipu-mangsa-scam-diperdaya-sindiket-menyamar-wakil-nsrc). Victims paid into several bank accounts and kept being asked for more, without getting anything back. PDRM has already had to disown one version of this. In May 2025, Bukit Aman's Commercial Crime Investigation Department said a Facebook advertisement using the PDRM name and logo to promise fraud victims their money back had no connection to the police and was itself a fraudulent attempt, [as reported by Bernama via Malay Mail](https://www.malaymail.com/news/malaysia/2025/05/18/scam-ad-promising-to-recover-scam-money-is-a-scam-itself-pdrm-warn/177151). Separately, a PDRM statement [reported by Utusan](https://www.utusan.com.my/nasional/2024/09/pemulangan-wang-kes-penipuan-hanya-oleh-pegawai-penyiasat-pdrm/) said that returning blocked scam money is handled only by the investigating officer under the law, with no shortcut through agents or other organisations. Treat any offer that borrows a police, NSRC or lawyer's name the same way: verify it directly with the agency before paying anything. The FBI's Internet Crime Complaint Center describes the same tactic abroad in its warning about [fictitious law firms offering to recover funds](https://www.ic3.gov/PSA/2025/PSA250813): fake lawyers who already know the exact amounts you lost and ask for "bank fees" to release the money. ## Real Help Versus Another Recovery Scammer Use this quick check on anyone offering to get money or an account back. *How to tell legitimate help from a recovery scam, based on NFCC, JSJK and FTC guidance at the time of writing.* | Question | Real agency, bank or service | Recovery scammer | | --- | --- | --- | | Who made first contact? | You contacted them, or they reply to a report you made | They found you through a comment, advert or direct message | | Do they ask for money before helping? | JSJK says the authorities do not ask for upfront payment to investigate or recover money | A deposit, processing fee, tax or release fee comes first | | Do they ask for passwords, PIN, TAC, OTP or backup codes? | Never. NFCC says NSRC, PDRM, MCMC, BNM and banks will not ask | Yes, often framed as needed to verify you or fix the account | | What do they promise? | No promises. NFCC says there is no guarantee money comes back | A sure recovery, often within a set number of days | | Which channel do they use? | Official numbers you can look up yourself, and police stations | Personal WhatsApp or Telegram accounts, group chats | | Can you verify who they are? | Yes, through the agency, the bank or the Malaysian Bar | Names, badges and letterheads that do not check out | For account recovery services in particular, our checklist on [whether a recovery service is legitimate](https://www.awarexone.com/research/is-account-recovery-service-legit-how-to-check) covers the questions to ask before you share anything, and our explainer on [fake hackers offering recovery](https://www.awarexone.com/research/fake-hackers-offering-account-recovery-scam) shows where those offers appear. ## Mistakes That Make Things Worse - Paying "one last fee" to unlock a refund. There is no final fee in a recovery scam. - Waiting days before calling the bank out of embarrassment. NFCC says late reports leave little chance of tracing the money. - Calling 997 but never making the police report. - Deleting the chats in anger before taking screenshots. - Trusting a new "recovery agent" because they already know your loss. ## Will You Get Your Money or Your Account Back? Be honest with yourself about the odds. NFCC says quick action can reduce losses but there is no guarantee the money comes back, and that once money has been gone for some time the chance is slim. Any money that is returned comes through the bank and the police process, not through a third party. A hacked or disabled social account is a separate question: only the platform can restore it, and some accounts are never restored. ## When a Case Review Makes Sense Everything above can be done alone, and the money side belongs with your bank and the police. Where a second opinion can help is the account side: if the scammer still has access to your email or social accounts, if you are not sure what they changed, or if the account you wanted back is still locked. SocialSafe by AwareXone, AwareXone's recovery service, looks at the case before anything is agreed, works only through the platforms' official processes, and will tell you if there is nothing more an outside party can do. You can read how our [account security](https://www.awarexone.com/services/account-security) work runs, and our [Trust Center](https://www.awarexone.com/trust) explains what we will never ask for, starting with your password and login codes. ## Frequently Asked Questions ### Can I get my money back from a fake hacker who took my payment? Possibly, but not reliably. Call your bank or 997 quickly and make a police report, because NFCC says fast action can reduce losses, though there is no guarantee any money is returned. ### Should I report it to the police if I paid someone to hack an account? Yes, report the fraud and describe honestly what you asked for and paid. The police need the full facts, including the bank accounts and numbers the scammer used, to follow up. ### Someone from NSRC messaged me offering to recover my money. Is it real? Treat it as a scam. NFCC says the NSRC, police and banks only contact people who have already made a report and never ask for passwords, PIN, TAC or OTP. Police have separately warned about a syndicate posing as NSRC representatives on WhatsApp who ask for an upfront fee to recover lost money, which the real NSRC never does. ### The scammer is threatening to post my details or tell people I hired a hacker. What do I do? Do not pay or reply. Save the threats as screenshots with dates, add them to your police report, and report the account to the platform. ### Can AwareXone get my money back from the scammer? No. Recovering lost money is a matter for your bank, the NSRC and the police; AwareXone's recovery work covers securing and recovering social media accounts, through official platform processes only. ## Official sources - [NFCC: National Scam Response Centre (NSRC) and FAQ (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [Bank Negara Malaysia: Report a fraud or get help (read 5 October 2026)](https://www.bnm.gov.my/web/financial-fraud-alert/report-a-fraud) - [MyGOV Malaysia: Scammer Account Verification Portal (read 5 October 2026)](https://www.malaysia.gov.my/en/topics/scammer-account-verification-portal) - [PDRM CCID: Semak Mule portal (read 5 October 2026)](https://semakmule.rmp.gov.my/) - [PDRM: Sistem Semakan Online, Soalan Lazim (read 5 October 2026)](https://sso.rmp.gov.my/FAQ.aspx) - [FMT: 2 kali ditipu, mangsa scam diperdaya sindiket menyamar wakil NSRC, 13 April 2026 (read 5 October 2026)](https://www.freemalaysiatoday.com/category/bahasa/tempatan/2026/04/13/2-kali-ditipu-mangsa-scam-diperdaya-sindiket-menyamar-wakil-nsrc) - [Malay Mail (Bernama): Scam ad promising to recover scam money is a scam itself, PDRM warn, 18 May 2025 (read 5 October 2026)](https://www.malaymail.com/news/malaysia/2025/05/18/scam-ad-promising-to-recover-scam-money-is-a-scam-itself-pdrm-warn/177151) - [Utusan Malaysia: Pemulangan wang kes penipuan hanya oleh pegawai penyiasat PDRM, 6 September 2024 (read 5 October 2026)](https://www.utusan.com.my/nasional/2024/09/pemulangan-wang-kes-penipuan-hanya-oleh-pegawai-penyiasat-pdrm/) - [US Federal Trade Commission: Refund and Recovery Scams (read 5 October 2026)](https://consumer.ftc.gov/articles/refund-and-recovery-scams) - [FBI IC3: Fictitious Law Firms Targeting Cryptocurrency Scam Victims, PSA I-081325-PSA (read 5 October 2026)](https://www.ic3.gov/PSA/2025/PSA250813) - [Google Account Help: Secure a hacked or compromised Google Account (read 5 October 2026)](https://support.google.com/accounts/answer/6294825) - [Facebook Help Center: Avoiding scams on Facebook (read 5 October 2026)](https://www.facebook.com/help/1674717642789671/) - [Facebook Help Center: Report a Facebook profile (read 5 October 2026)](https://www.facebook.com/help/report) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.