How to Report a Hacked Account in Malaysia

Someone took over your Facebook, Instagram or Gmail. They may be messaging your friends for money, or your bank app may already show a transfer you did not make. You want to report it, and every site points somewhere else: the police, 997, Cyber999, MCMC.

Each one handles a different part of the problem. The platform is the only one that can return the account. Your bank and the National Scam Response Centre (NSRC) on 997 handle money that has left your account. A police report records the crime. Cyber999 takes the computer security incident itself.

This guide sorts out which report to make, in which order, what each one needs from you, and what none of them can do.

Last checked: 29 September 2026.

#Where Do You Report a Hacked Account in Malaysia?

Start with the platform's own hacked account page, such as facebook.com/hacked or instagram.com/hacked, because only the platform can restore access. If money left your bank account, or you were tricked into transferring money, call your bank's hotline or NSRC on 997 straight away, then make a police report at the nearest police station. Hacking is an offence under the Computer Crimes Act 1997 and PDRM enforces it, but the online e-Reporting system does not take crime reports, so go in person. Then report the incident to CyberSecurity Malaysia's Cyber999. MCMC is the route for harmful content and telco complaints, not for getting an account back.

#Which Agency Handles What?

One takeover can touch five organisations at once. Here is what each one does, from its own pages.

#Step One: Report It to the Platform

The platform report is the only one that can get you back in, so do it first unless money is moving right now.

• Facebook: Meta's page on recovering a hacked Facebook account says to visit facebook.com/hacked, ideally on a device you have used to log in before. It also says that when your email is changed, Facebook sends a message to the old address with a link to reverse the change.
• Instagram: Instagram's page on a hacked profile says an email from [email protected] about a changed email address may let you undo it with "secure my account". If that fails, it describes requesting a login link through "Forgot password?", and a video selfie check for accounts with photos of you.
• Google and Gmail: Google's page on securing a hacked account sends you to the account recovery page if you cannot sign in, and asks you to review security events, devices, and Gmail forwarding rules and filters you did not set.

Secure the email account behind your social accounts before anything else. Whoever controls that inbox can reset the password again after you report. For a step-by-step version for Instagram, see what to do in the first hour after an Instagram hack.

#If Money Was Lost: Your Bank and NSRC 997 Come First

If money has left your account, speed matters more than paperwork. The National Anti-Financial Crime Centre's NSRC page says NSRC focuses on online financial fraud: money transferred out of your bank account without your knowledge, or money you were tricked into transferring through an online financial service. It names phishing and malware among the methods, which is how many account takeovers end.

The same page says to contact your bank's 24-hour hotline or call 997 as soon as you discover the fraud, and that if you cannot get through to 997, you can go straight to your bank's hotline. The number is on the back of your bank card or on the bank's website. NSRC can try to block the stolen funds, but the page is clear that there is no guarantee you will get the money back.

NFCC also says 997 is an emergency response number, not a line for following up a case; follow-ups go to the investigating officer on your police report. If your own bank account has been blocked, contact your bank instead.

If friends sent money to the attacker because your account asked them to, they are the fraud victims, and they should call their own bank or 997. Our guide on what to do when a hacked account messages your friends covers what to tell them.

#Making a Police Report About a Hacked Account

Go to a police station. PDRM's online e-Reporting system says it is for lost documents or items that do not relate to crime. Before you can file, it asks you to tick "I hereby confirm the police report that I am lodging does not involve any crime matter." For anything with a criminal element, it shows: "This case involves criminal element. You are advised to lodge a police report at the nearest police station."

Hacking is a crime. MCMC's complaints page lists hacking under the Computer Crimes Act 1997 and cheating by personation under the Penal Code, both enforced by the Royal Malaysia Police. If someone is in danger or the situation is still unfolding, the e-Reporting page says to dial 999.

If money was involved, NFCC says you need to make the police report at the nearest station within 24 hours of contacting your bank or 997, and that without a police report the police cannot follow up. With no money lost, a report is still worth making when someone is using your identity, when the attacker threatens you, or when you need an official record.

A police report does not make the platform restore your account. None of the Meta or Google hacked account pages we checked asks for one. Report to the platform in parallel, not after. If you are weighing a civil claim as well as a criminal report, our explainer on whether hacking is a crime in Malaysia sets out the difference.

#Evidence Checklist: What to Bring to Each Report

NFCC's page lists what a fraud report needs: a short chronology, your details, the suspect's details, transaction details and receipts, any website address the scammer shared, and your communication with them. For a hack, we suggest gathering the following before you go, whether or not money was lost:

• A written timeline: when you first noticed, what changed, and when you lost access.
• Screenshots of every email or alert from the platform about a new login, a changed email or phone number, or a changed password, with the date visible.
• The account's username, profile URL, and the email and phone number it used before the attacker changed them.
• Any phishing link, fake login page or message that started it, including who sent it and when. Do not open the link again to screenshot it.
• Screenshots of messages the attacker sent from your account, and from friends who received them.
• Bank or e-wallet transaction references, amounts and times, if money moved.
• The platform's case or ticket email, if it sent one.
• Your MyKad, for the police report.

#Reporting to Cyber999

CyberSecurity Malaysia describes Cyber999 as the national point of contact for reporting computer security incidents. It provides technical analysis and helps Malaysian internet users escalate abuse reports to the relevant parties. It is not a police service and does not replace a police report.

MyCERT's reporting channel page lists four ways to report: the online form, email to [email protected], the Cyber999 mobile app, and the 1-300-88-2999 line during office hours. It says calls are monitored during business hours, 8.30am to 5.30pm. For email reports, it asks for the source and time of the attack, email headers and log files where you have them.

The Cyber999 online form asks for your name, age group, email and phone, how many days ago the incident started, the suspected incident type, and a short description. For a stolen social media password, the closest types on the form are:

• Fraud, which the form describes with examples including identity theft and stolen passwords.
• Phishing, if a fake login page or message tricked you into typing your details.
• Intrusion Attempt, if someone tried to get in and you stopped them.

#Where MCMC Fits, and Where It Does Not

Many people search for "MCMC aduan" first. MCMC's complaints page covers communications services and online content, and its own table lists hacking as a matter for PDRM. MCMC is not the place to get an account back.

MCMC is useful in two situations. If your carrier moved your number to another SIM without proper checks, the page says to complain to your service provider first, then to the Communications and Multimedia Consumer Forum, and then to MCMC through the complaints portal at aduan.mcmc.gov.my. It lists the MCMC Consumer Care Centre on 1800-188-030, 8.30am to 5.30pm, Monday to Friday. And if the attacker posted obscene, menacing, false or offensive content from your account, that falls under the online content problems MCMC lists.

#Mistakes That Make Reporting Harder

• Waiting to report to the platform until you have a police report. The platform does not need one, and the delay gives the attacker time to change more details.
• Trying to file a hacking report through e-Reporting. It is for non-crime matters, and the system tells you to go to a station.
• Calling 997 to ask about a case you already reported. NFCC says follow-ups go to the investigating officer.
• Deleting the attacker's messages or the platform's alert emails before you screenshot them.
• Paying a "hacker for hire" or an "unban" seller who promises to get the account back. Breaking into an account is itself a crime, and these offers are a common scam.
• Stating anything in a police report you are not sure of. The e-Reporting page warns that giving false information is an offence under section 182 of the Penal Code, and that applies at the counter too.

Fake support pages often target people straight after a hack. Our breakdown of the fake Meta support scam shows what they look like.

#When Expert Recovery Help Makes Sense

You can make every report in this guide yourself, and most people should. A second pair of eyes helps when the platform's hacked account flow keeps failing, when a business or creator account is involved, or when a SIM swap, a stolen email and lost money are all tangled together. SocialSafe by AwareXone, our recovery service, reviews what has happened first and tells you honestly which official route is still open. We are a Malaysian team, so we know how the NSRC, PDRM and bank reports sit alongside the platform's process. Our account security service explains how a review works, and our Trust Center lists what we will never ask you for, including your password and login codes.

#Frequently Asked Questions