How to Prove You Own a Social Media Account

You run a small baking business in Shah Alam through Instagram. Last night someone changed the email and phone on the account, and this morning Instagram's support flow wants to know who you are. You have a MyKad, an SSM certificate, a folder of Meta ad receipts and years of photos on the profile. The question is which of these Instagram will actually look at.

Every platform decides ownership the same way: it compares what you give it with what it already holds about the account. The original email and phone, your face in the profile photos, the devices you logged in from and, for businesses, documents that match the name. Evidence that matches those records helps. Evidence the platform cannot check, however heartfelt, rarely does.

This guide sets out what Instagram, Facebook and TikTok ask for, what each will not accept, how to send an ID without creating a second problem, and a checklist to build your evidence pack.

Last checked: 28 September 2026.

#How do you prove a social media account is yours?

You prove ownership by showing the platform something that matches its own records. The strongest proof is control of the email address or phone number on the account, because a login link or code sent there settles the question. Without that, Instagram and Facebook may ask for a video selfie that is compared with the photos on the account, or a photo of an ID whose name matches the profile. Instagram may also ask for the email or phone you signed up with and the type of device you used. Facebook works best from a device you have logged in on before. TikTok offers login codes, verification by at least two friends and a "Need more help?" request. Send ID only through the platform's own app or help centre, never to someone in your messages. The platform makes the final decision.

#What does "proving ownership" mean to a platform?

To a platform, proving ownership means passing a check it designed, using data it already has. The support team does not know you. It knows the account's contact details, its login history, its devices, its photos and, for Pages and ad accounts, the business details and payment records attached to it.

That is why a short, matching piece of evidence beats a long explanation. A login from your usual phone on your usual home Wi-Fi says more to Meta than three paragraphs about how long you have had the account. It also explains why some accounts are harder to recover: an account with no photos of you, a personal email you no longer use and no recognised device leaves the platform very little to compare against.

#What Instagram asks for

Instagram's hacked account guidance works through its checks in order, from easiest to hardest. At the time of writing, it looks like this:

1. An email from [email protected]. If Instagram emailed you that your email address was changed, the "secure my account" option in that message may undo the change.
2. A login link or security code sent to the email or phone on the account, requested from "Forgot password?" on the login screen.
3. A support request made from a mobile device, where you give a secure email address that only you can access.
4. Identity verification. For an account without photos of you, Meta's support team emails you and asks for the email address or phone number you signed up with and the type of device you used at sign-up (for example iPhone, Android or iPad).
5. For an account with photos of you, a video selfie in which you turn your head in different directions.

Instagram says it uses selfies because photos and IDs can be digitally modified, and that you will not have access to the account while it reviews the video. If you pass, a reset link goes to the secure email you gave. If you fail, you may be able to submit a new selfie. Instagram also says the video is never visible on Instagram and is deleted within 30 days.

Instagram may also ask for an ID. Its list of accepted IDs has two groups. One item from the first group is enough if it shows your full name and either your photo or your age: examples include a passport, a driving licence, a birth certificate and a national ID card, which for most Malaysians means a MyKad. Without a photo ID, you can send two items that both carry your full name, with at least one showing your photo and age. The second group includes bank statements, utility bills, payslips, school or university records and work IDs. Instagram asks you to send only what is required, because extra documents may delay the review.

Our guide to Instagram account recovery in Malaysia covers what to do when these steps stall.

#What Facebook asks for

Facebook leans on familiar devices more than any other platform. Its hacked account page tells you to go to facebook.com/hacked on a device you have used to log in before. If you cannot reach the email or phone on the account, Facebook's recovery steps say the process works best on a familiar device, which can be your own phone, an old phone or a family member's laptop you once logged in on.

1. Go to facebook.com/login/identify on that familiar device and search for the account by email, phone or username.
2. Select "No longer have access to these?". You may see "Forgot account?" or "Recover" instead.
3. Give new contact details when asked. Facebook says these must not have been used on the account before.
4. Follow the prompts to confirm the account belongs to you, then reset the password.

The confirmation step can be an ID or a video selfie. Facebook's accepted ID page takes one government ID showing your name with either your date of birth or your photo, such as a national identity card, passport, driving licence or birth certificate. If you have none, you can send two non-government IDs that carry your name, at least one with your date of birth or photo. When you have lost access, the photo or date of birth may need to match the details on the account.

Where Meta offers it, a video selfie can replace the ID. Meta's facial recognition help page says it compares the selfie with the photos on your Facebook or Instagram profiles, including previous Facebook profile photos, and deletes the comparison data once it is done, match or not. If the automated check cannot confirm a match, or you decline facial recognition, your selfie or ID may go to manual review or you may be asked to confirm your identity another way. This option is not available in every country, so follow what your screen offers.

For the wider Facebook recovery process, including disabled accounts and 2FA problems, see our guide to Facebook account recovery in Malaysia.

#What TikTok asks for

TikTok starts with the same test as everyone else: a code or link sent to the phone or email linked to the account, from "Forgot password?" on the login screen. After that, its help pages describe two further routes.

• Friend verification. TikTok's account safety page describes asking friends you are connected with on TikTok to verify you, starting from Help, then "Recover your account", then "Can't access these?". At least two friends must confirm, and they see the request in their own Security & permissions settings.
• "Need more help?". If the usual methods do not work, TikTok's email and phone help points you to "Need more help?", and says the process may take up to 30 days. The in-app Report a problem tool leads to the same request.

TikTok's help pages say only that the form helps it verify your identity; they do not publish a fixed list of the questions it asks, and what it asks may vary by case. From the account's own records, the details worth preparing before you start are: the exact username, every email and phone number that was ever linked, the device model you normally use, roughly when you created the account, and whether you signed up with Google, Apple, Facebook or another account. Answer accurately and consistently. A guess that contradicts TikTok's records does more harm than an honest "I am not sure".

Our guide to TikTok account recovery for Malaysian creators walks through the rest of TikTok's process, including bans and appeals.

#Which evidence counts, and where?

Not every item on your list is accepted everywhere. This table maps the common types of evidence to where they are used at the time of writing. "Supporting" means it helps you answer questions or fill in forms accurately, not that the platform accepts it as proof on its own.

#Supporting evidence to prepare before you apply

Supporting evidence rarely proves ownership by itself, but it makes every answer you give accurate and consistent. Gather it before you open a recovery form, not halfway through one.

• The original sign-up email. Search your old inboxes for the platform's welcome email. It shows which address and roughly which year you signed up.
• Old security emails. Instagram and Facebook send notices when an email, phone or password changes. Keep the original emails, since they record what changed and when.
• Dated screenshots. Profile screenshots showing the username, profile URL and date are useful for your timeline and for reporting impersonation.
• Account identifiers. The exact username, any previous usernames, and for businesses the Page ID, business portfolio ID and ad account ID.
• Ad receipts and invoices. Meta or TikTok ad receipts show which ad account and payment method belong to you, which helps if support asks about ad activity or unauthorised spend.
• Creator records. Brand contracts or invoices that name the handle, and platform payout statements.

For a business Page, Facebook publishes a separate list of business documents it can use to confirm your association with a business when it asks for documentation. It includes formation or incorporation documents, a local business licence, a utility bill and a tax filing. For a Malaysian business, your SSM registration documents are the closest local equivalent of the registration papers on that list. The business name on them should match the Page name. If the Page carries a brand name different from your registered name, keep something that links the two. If the Page itself is lost, our Facebook Page recovery service explains how those cases differ.

#What platforms will not accept

Some evidence looks convincing to you but gives the platform nothing it can check. Facebook's business documents page says it cannot confirm your link to a business with any of these:

• Business cards or images of logos.
• Domain ownership documentation.
• Letterheads or envelopes.
• Personal letters or email correspondence.
• Screenshots of, or links to, a website or Wikipedia page.
• Flyers.
• Photos of your place of business.
• Editable documents, or documents that are readily available to the public.

Across personal accounts, the same logic applies. Instagram and Facebook do not accept ID photos that have been digitally edited to hide information. Messages from friends or followers saying the account is yours carry no weight outside TikTok's own friend verification, because the platform cannot verify them. Undated screenshots, follower counts and long emotional explanations add little. And sending more documents than asked for can slow the review down.

#How to send your ID without creating a new problem

An ID photo is valuable to a scammer, so send it only where it is safe. Use this sequence:

1. Upload only inside the official flow: the Instagram, Facebook or TikTok app, or the platform's own help centre reached by typing the address yourself. Never upload through a link sent in a DM, a chat message or an email you did not expect.
2. Check who is asking. Meta says its representatives never ask for your password, payment details or other sensitive information over chat, text, email or phone, and it publishes the email domains it sends from. TikTok says it will never ask for your account password or multifactor code.
3. Cover what is not needed, physically. Instagram and Facebook say they ignore ID numbers they do not need and suggest physically covering non-essential details before taking the photo. They reject images that are digitally edited to hide information, so cover with paper, not an app.
4. Photograph the document flat, in good light, with all four corners visible.
5. Delete the photo from your gallery afterwards. Facebook's ID storage page recommends this, because the picture may stay on your device.

Never send your password, a one-time code, backup codes or a screenshot of them to anyone. That includes anyone claiming to be from Meta or TikTok, any recovery "agent", and us. Our Trust Center sets out what AwareXone will and will not ask for. If a message about your account pushes you to act within hours, read our breakdown of the fake Meta Support scam in Malaysia before you reply.

#Your evidence-pack checklist

Build this pack while you still have access, and update it once a year. Keep it offline or in a cloud account protected with two-factor authentication, not in the email linked to the social account.

• The exact username and profile URL of every account, plus any previous usernames.
• Every email address and phone number ever linked to each account, and whether you still control them.
• The name of the original sign-up email account and the year you signed up.
• The device model you normally use, and a note of any old phone still able to log in.
• A dated screenshot of each profile with the username visible.
• Saved platform security emails about email, phone or password changes.
• Backup codes for each account, stored away from your phone.
• A clear, current government ID whose name matches the account, kept offline.
• For TikTok: two or more friends on the app who would confirm a verification request.
• For businesses: SSM registration documents, a utility bill or tax filing in the business name, the Page ID, business portfolio ID, ad account IDs and a few recent ad receipts.
• For creators: contracts or invoices naming the handle, and payout statements.

If the pack is thin because you no longer control the email or phone, our guide to recovering access after losing your email, phone or 2FA shows what to recover first.

#What if your evidence is not enough?

Sometimes it is not, and it helps to know that early. An account with no photos of you, no reachable contact details and no familiar device gives the platform very little to match. A Page registered to a name you cannot document is in the same position. No evidence pack forces a decision: only the platform can restore an account, and some accounts are not restored.

SocialSafe by AwareXone, our recovery service, starts every request by looking at which of these items you actually have. That tells us which official route still has a realistic chance, and sometimes the honest answer is that you can do it yourself with the steps above. Start on the recovery hub. For accounts that carry a business or a creator income, see business and creator recovery.

#Frequently Asked Questions