# Police Report for a Hacked Account: What to Bring > Making a police report for a hacked account in Malaysia? What to bring to the station, how to write the chronology, and what happens after you lodge it. - URL: https://www.awarexone.com/research/police-report-hacked-account-malaysia-what-to-bring - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: Account recovery, Scams, Malaysia - Related service: Social media problem solutions: https://www.awarexone.com/all-types-of-social-media-problem-solutions ## Short answer Go to any police station with your MyKad, a dated chronology of the hack, the account username and link, the platform's security emails, screenshots of the hacker's messages and, if money was lost, receipts and the receiving account numbers. Call your bank or 997 first if money moved. The report does not restore the account; the platform decides that. ## Summary - Hacking is a crime in Malaysia, so make the report in person at any police station, because PDRM's online e-Reporting system does not take crime reports. - Bring your MyKad, a dated written chronology, the account username and link, the security emails from the platform and screenshots of every message the hacker sent. - If money moved, call your bank or the National Scam Response Centre on 997 first, then make the police report at a station within 24 hours. - Print or save your evidence beforehand so you never have to hand over an unlocked phone, and read the report carefully before you accept it. - Nobody who offers to trace the hacker or restore the account through police contacts is genuine, and PDRM, NSRC and banks never ask for your password or OTP. - A police report records the crime and can start an investigation, but it does not make the platform return your account, so report the hack to the platform as well. Someone took over your Facebook, Instagram or TikTok. They may be asking your friends for money, or a transfer you never made has already left your bank account. You have decided to make a police report, and now you want to walk into the station once, with everything the officer needs. The short answer: bring your MyKad, a written timeline with dates and times, the account details, the security emails the platform sent you, and screenshots of what the attacker did. If money was involved, add receipts, bank statements and the account numbers that received the money. Below: the full checklist, a statement template, what happens at the counter and after, and mistakes to avoid. Unsure which agency handles what? Start with [where to report a hacked account in Malaysia](https://www.awarexone.com/research/report-hacked-account-malaysia). Last checked: 5 October 2026. ## What Should You Bring to a Police Report for a Hacked Account? Bring proof of who you are, proof the account is yours, and proof of what the attacker did. PDRM's [public FAQ](https://rmp2u.rmp.gov.my/faq) says a report can be made at any police station and that you should give complete information and bring related documents or evidence. Its examples include transaction receipts, bank statements, receiving account numbers, phone numbers, screenshots of conversations, links, email addresses and social media usernames. For a hacked account, add your MyKad, a dated chronology, the changed email or phone and the platform's security emails. Print the key items or save them in one folder so you can show them without handing over an unlocked phone. ## Do You Need a Police Report for a Hacked Account? Often, yes. MCMC's [FAQ on hacked accounts](https://www.mcmc.gov.my/en/faqs/online-content-problems/7-email-facebook-blog-site-account-was-hacked-what) says hacking falls under PDRM's jurisdiction, that action can be taken under the Computer Crimes Act 1997, and that reports can be lodged at any police station. MCMC's [complaints page](https://www.mcmc.gov.my/en/make-a-complaint/make-a-complaint) lists both hacking and cheating by personation as matters for PDRM. Our explainer on [whether hacking is a crime in Malaysia](https://www.awarexone.com/research/hacking-crime-malaysia-victims) covers the law itself. PDRM's FAQ adds that you can come forward to report attempted fraud, threats or identity misuse, so you do not have to wait until money is lost. The table shows what comes first. *When a police report fits a hacked account in Malaysia, based on PDRM, NFCC and MCMC pages at the time of writing.* | Your situation | Police report? | Do this first | | --- | --- | --- | | Money left your bank account or e-wallet | Yes, at a station within 24 hours of calling your bank or 997 | Call your bank's hotline or NSRC on 997 | | The hacker is asking your friends or followers for money | Yes, the attacker is using your identity | Warn contacts from a channel you still control | | The hacker threatens to leak photos or messages | Yes; call 999 if anyone is in immediate danger | Do not pay or reply; save the threats | | Account taken, no money lost, no messages sent in your name | Optional, but useful as an official record | Use the platform's hacked account page | | You only lost access after forgetting your password | No, there is no crime to report | Use the platform's normal recovery flow | > Note: **The online form will not take this report.** PDRM's [e-Reporting system](https://ereporting.rmp.gov.my/index.aspx?lang=english) says it is for lost documents or items that do not relate to crime, and asks you to confirm your report does not involve any crime matter. When a case has a criminal element, it tells you to lodge the report at the nearest police station. A hacked account is a crime report, so go in person. ## The Evidence Checklist: What to Take to the Station The NFCC's [NSRC FAQ](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) sets out what you need when reporting an online financial scam, whether to your bank, to 997 or at a police station: a brief chronology, your personal details including your identity card number, details of the suspect, transaction details, receipts, links the criminals shared and your communication with them. For a hacked account, add proof that the account is yours. *Evidence checklist for a police report about a hacked social media account.* | Bring this | Why it matters | Where to find it | | --- | --- | --- | | Your MyKad or other identity document | NFCC lists your identity card number among the details you need | Your wallet | | A written chronology with dates and times | PDRM asks for a clear chronology; it keeps the report accurate | Write it before you go, using the template below | | The account username and full profile link | Identifies exactly which account was taken | Your profile URL, or a friend can copy it from their app | | The email and phone number that used to be on the account | Shows which recovery details the attacker changed | Your own records; old bills or sign-up emails | | Security emails from the platform | Proves when the email, phone or password was changed | Your inbox: messages such as a login alert or an email change notice | | Screenshots of the hacker's messages and posts | Shows what was done in your name | Your inbox, plus what friends send you | | Screenshots from friends who were asked for money | Evidence of impersonation and attempted fraud | Ask friends for screenshots showing the date and the account | | Receipts, bank statements and the receiving account numbers | Lets the police and banks trace the money | Your banking app or e-wallet history | | Your bank or 997 case reference, if you have one | Links the police report to the money report | Your call notes or bank SMS | | Any platform case or ticket reference | Shows you reported to the platform too | Confirmation emails from the platform | ## Prepare Your Phone and Screenshots Before You Go Your phone holds the evidence and also your banking apps and private life. Prepare it so you never hand it over unlocked. 1. Take screenshots that show the date, time and the account name in the frame. On a computer, include the address bar so the URL is visible. 2. Copy the hacker's username and profile link as text, not only as an image. Usernames change; a link or a number is easier to trace. 3. Forward the platform's security emails to a folder you control, or save them as PDFs. 4. Put everything in one album or folder, numbered in the order of your chronology. 5. Print the chronology and the key screenshots if you can. A printed bundle is quicker to go through at the counter. If an officer needs to see something on the phone, open that item yourself. Our guide on [what to prepare before an account recovery case](https://www.awarexone.com/research/what-to-prepare-before-account-recovery-case) uses the same evidence, so one bundle serves both the police and the platform. ## How to Write the Statement: A Chronology Template PDRM's FAQ says your report should set out a clear chronology, including dates, times, how the contact or communication happened, phone numbers, bank accounts, transaction amounts, why any payment was made, the identity the suspect used, and all related evidence. Write it in short numbered lines. Stick to what you saw yourself and mark anything you are unsure of. > Example layout only; replace everything in brackets. 1. I am the owner of the [platform] account [username], link [profile URL], registered to my email [address] and phone [number]. 2. On [date] at about [time], I received a message from [sender] asking me to [what they asked]. 3. At [time], I received an email from [platform] saying my email address had been changed. I did not make this change. 4. At [time], I could no longer log in. 5. From [date], friends told me the account was asking them for money. [Name] transferred [amount] to account [number] at [bank] on [date]. 6. I reported the hack to [platform] on [date], reference [number], and called [bank or 997] on [date], reference [number]. 7. I did not give anyone permission to access my account. - Use the 24-hour clock or say morning and evening, and keep one time zone. - Name the platform, the exact username and the link, not just "my Facebook". - Say what you did not do: you did not change the email, share the password or approve the login. - If you clicked a link or shared a code, say so plainly. Officers and banks need the real sequence, and leaving it out weakens the report. - Do not guess who the hacker is. Give the usernames, numbers and links you saw, and let the police investigate. ## At the Counter: What Happens When You Lodge the Report You explain what happened, reading from your chronology, and the officer records it. Before you accept the printed report, read it line by line and ask for corrections if a date, an amount, a username or an account number is wrong. Keep expectations realistic. PDRM's FAQ says a police report is the start of a review or investigation, and that any action, including an arrest, depends on the facts, evidence and law. It also says that if a matter has no criminal element or falls under another agency's jurisdiction, it may be directed to that agency or another suitable channel. > Warning: **Only state what is true.** PDRM's e-Reporting page warns that providing false information is an offence under section 182 of the Penal Code, and PDRM's FAQ says a false complaint can lead to legal action. Do not exaggerate losses or name a suspect you cannot point to with evidence. An honest report with gaps is stronger than a confident one that is wrong. ## After the Report: The Copy, the Investigating Officer and the Platform Keep your copy of the report and write down the report number. NFCC says that after you make the report you will be given its result or referred to the PDRM investigating officer assigned to your case, and that follow-ups go to that officer. NFCC also describes 997 as an emergency response line, so it is not the number for chasing an update. - Photograph the report and keep the paper copy safe. - Note the investigating officer's name and contact details if you are given them. - Give your bank the report number if money was taken and the bank asks for it. - Send fresh evidence to the officer, such as new messages the hacker sends to your contacts. - Report the hack to the platform in parallel. A police report does not make the platform restore the account; the platform runs its own process and makes its own decision. You can also report the computer security incident to CyberSecurity Malaysia's [Cyber999](https://www.cybersecurity.my/portal-main/services/cyber999-overview), which acts as the national point of contact for such incidents and helps internet users escalate abuse reports. It is separate from the police report and does not replace it. If your friends lost money because of messages sent from your account, our guide for [when contacts were scammed from your hacked account](https://www.awarexone.com/research/friends-scammed-from-my-hacked-account-malaysia) explains what each of them should do. ## Mistakes That Weaken a Hacked Account Report - Going to the station before calling your bank or 997 when money is moving. NFCC advises contacting the bank or NSRC first so action can start on the funds. - Arriving without a written timeline and reconstructing dates at the counter. - Bringing only screenshots that crop out the date, the username or the link. - Trying to identify, contact or get into the attacker's accounts yourself. It can destroy evidence and may itself be an offence. - Leaving out a code you shared or a link you clicked because it feels embarrassing. - Losing the report number, which you need for the bank, the investigating officer and any later follow-up. ## "Police Contacts" and Hackers Who Offer to Trace the Attacker Post about the hack and strangers appear in the comments, in English, Bahasa Malaysia or Chinese, claiming they can trace the attacker or know someone in the police or at Meta. They want payment up front or your login details. > Warning: **Nobody genuine asks for your codes.** NFCC says NSRC, PDRM, MCMC, Bank Negara Malaysia and the banks will only contact you after you have reported to them, and will never ask for your username, password, PIN, TAC or OTP. PDRM's FAQ warns about anyone who tells you to transfer money for investigation or verification. Never share a password, login code or backup code with anyone, and never pay someone to trace a hacker or unlock an account. If you have already paid one of these people, treat it as a second scam: call your bank or 997 and add it to your police report, or make a new one. Our guide to the [NSRC 997 hotline](https://www.awarexone.com/research/nsrc-997-scam-hotline-what-happens) explains what happens after you call. ## When a Case Review Makes Sense You can make the police report yourself, and you should. Getting the account back is a separate process run by the platform, and it is where people get stuck. A review helps when the platform's hacked account flow keeps failing, when the attacker changed the email, phone and two-factor settings, or when a business page or creator account is involved. SocialSafe by AwareXone, our recovery service, looks at the case first and tells you honestly whether an official route is still open. We work only through the platform's own processes, the platform makes the final decision, and some accounts do not come back. Our [social media problem solutions hub](https://www.awarexone.com/all-types-of-social-media-problem-solutions) explains how a case review works, and our [Trust Center](https://www.awarexone.com/trust) sets out what we never ask for, including your password, OTP and backup codes. ## Frequently Asked Questions ### Can I make a police report for a hacked Instagram account at any station? Yes. PDRM's FAQ says police reports can be made at any police station, and MCMC says reports about hacking can be lodged at any nearest station. You do not have to go to the station closest to your home. ### Do I need a police report to recover my Facebook account? Not usually. The platform runs its own recovery process through its hacked account pages, so report to the platform straight away instead of waiting for a police report. The report matters for money, identity misuse and an official record. ### What if I do not know who hacked my account? That is normal. Report the usernames, links, phone numbers and bank accounts you saw, and leave identification to the police. Do not try to trace the attacker yourself. ### Can I bring a friend or family member to the police station? Bringing someone for support is reasonable, and their screenshots help. A friend who lost money to the hacker is a victim too and may need to make a report of their own about that transfer. ### Will the police get my money back? Not always. PDRM's FAQ says recovering money depends on how quickly the report was made, where the money sits and whether it was frozen, and that there is no assurance all of it can be recovered. Calling your bank or 997 quickly gives the best chance. ## Official sources - [PDRM (RMP2U): Frequently asked questions, general and JSJK commercial crime (read 5 October 2026)](https://rmp2u.rmp.gov.my/faq) - [NFCC: About NSRC and frequently asked questions (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [PDRM: e-Reporting (read 5 October 2026)](https://ereporting.rmp.gov.my/index.aspx?lang=english) - [MCMC: Make a complaint, online content enforcement table (read 5 October 2026)](https://www.mcmc.gov.my/en/make-a-complaint/make-a-complaint) - [MCMC FAQ: Email/Facebook/blog site account was hacked. What should I do? (read 5 October 2026)](https://www.mcmc.gov.my/en/faqs/online-content-problems/7-email-facebook-blog-site-account-was-hacked-what) - [CyberSecurity Malaysia: Cyber999 overview (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.