Fake Account Using My Photos (Malaysia): Report FB, IG, TikTok

Screenshot the fake profile, copy its URL, report it as impersonation on Facebook, Instagram or TikTok, and warn your contacts on another channel. If money was requested or sent, contact your bank or NSRC 997 and consider a police report. Platforms decide removals. A Malay-language version lives at `/ms/research/report-fake-account-using-my-photos-malaysia`.

#Someone made a fake account with my photos. What do I do first?

Save the profile URL, username, dated screenshots, your original photos and any messages sent to friends. Report as impersonation, then warn contacts. Do not pay the impersonator or a random broker.

#Collect evidence first

Keep URLs, usernames, screenshots, originals and, only when an official form asks, government ID uploaded inside that form. Guide: collect evidence.

#How to report on each platform

Facebook: profile menu → report → pretending to be me (Help); no account: form. Facebook fake profile guide.

Instagram: Report account → pretending to be someone else (Help, form). Instagram impersonation guide.

TikTok: Report → Pretending to Be Someone (TikTok Help). Outside the US, online forms often use Report a potential violation → Account violation → Impersonation. TikTok guide.

#Can I report without an account, or if the fake is private?

Facebook and Instagram offer paths without an account. Private profiles can still be reported from what you can see; friends who follow them can supply screenshots.

#What proof will platforms ask for?

Links, explanations and sometimes ID or a selfie on official forms. Businesses may add trademark papers. Never send IC photos to strangers in chat.

#If the fake account is scamming friends in Malaysia

Warn people, call the bank or NSRC 997 (MyGOV), file a police report when fraud occurred, and keep platform reports going. NSRC guide. Report hacked account Malaysia.

#Is this a crime in Malaysia?

Using your photo alone is not automatically an offence. Penal Code s.416 (cheating by personation) and s.419 apply when cheating elements exist (AGC). Not legal advice.

#MCMC complaints

MCMC is an additional channel for some issues. It does not replace platform impersonation reports.

#If the platform rejects the report

Improve evidence, ask targeted friends to report, search other apps, consider deepfake removal guidance, and avoid fake Meta support.

#When AwareXone can help

Case review. 1,300+ cases, anonymous clients, official channels only, no passwords or OTPs, no promised outcomes. MYR after review in Malaysia; USD after review elsewhere. Impersonation removal, trust, pricing.

"Impersonation reports move when the URL, screenshots and ownership proof are tidy. File as impersonation, not spam." - Md Shariar Shanaz Shuvon, Founder, AwareXone

Malaysia readers often discover a fake profile when a relative forwards a payment request. Treat that message as a fraud alert: tell them to stop, keep the screenshot, and move your own reporting to Facebook, Instagram or TikTok official forms the same day.

Usernames change quickly after a report. That is why copying the full profile URL and, where visible, any numeric ID matters as much as the display name. If the fake account also runs ads or a Facebook Page, capture those URLs in the same evidence folder.

When friends ask whether they should mass-report, explain that platforms do not publish a quota that promises removal. A few detailed impersonation reports with clear photo comparisons usually beat dozens of generic spam reports that omit the real owner.

Business owners should check whether the fake account is messaging customers about orders, refunds or bank details. If yes, post a warning on your real channels, pause any chat workflows that could confuse buyers, and keep marketplace or WhatsApp Business logs for the police if money moved.

Deepfake or face-swap posts still need the same evidence discipline: original files, timestamps and the fake URL. AwareXone's deepfake guide covers video-specific paths, but the first hour is still screenshot, report and warn contacts.

SocialSafe by AwareXone publishes education like this so victims do not have to learn the forms under pressure. When you request a case review, you still decide whether to proceed after you see the written scope and fee in MYR for Malaysia or USD after review elsewhere.

Keep platform security emails and SMS. Even in an impersonation case that is not a takeover of your real login, those messages help show which accounts remain yours when support forms ask for history.

If you hold a registered trademark, an IP report can sit beside an impersonation report on some surfaces. Use the trademark path only when you actually own the right in that market; false IP claims create their own problems.

Public holidays and shopping campaigns often bring more fake promo accounts using stolen photos. Slow down, verify handles against your website, and teach staff not to approve admin invites from unknown profiles.

Finally, remember that removal of a fake account does not automatically recover money already sent. Banking and NSRC steps remain separate from Meta or TikTok enforcement.

If the fake account uses a WhatsApp number in its bio, do not call that number to "verify". Report the social profile first, then treat the number as part of the scam evidence for NSRC or the police if money moved.

Schools, clinics and local shops in Malaysia are frequent impersonation targets because their logos and staff photos are easy to find. Designate one staff member to own reporting logins and keep the IP or page admin list short.

When Instagram asks for a selfie holding your ID, follow the on-screen framing rules and use a plain background. Blurry MyKad photos are a common reason forms bounce.

After a fake account is removed, search again in a week. Clones reappear with a digit added to the username. Keep your evidence folder so the second report is faster than the first.

Last checked: 14 October 2026. Platform policies change; always confirm steps on the provider's own help pages before you act.

SocialSafe by AwareXone works only through official platform channels, never asks for passwords or one-time codes, and states that platforms make the final decision. See the Trust Center and pricing for how a case review works.